CVE-2026-3430

This is an unauthenticated SQL injection in Creative Mail's abandoned cart callback handler — one of the most dangerous locations a SQL flaw can occupy in a WooCommerce environment. The endpoint receives data from Creative Mail's external service without authentication, then constructs SQL without using WordPress's $wpdb->prepare(). The vulnerable code path lives in how the plugin processes abandoned cart events that WooCommerce generates server-side, passing data from WooCommerce's schema into the plugin's own database operations without re-sanitizing at the boundary. The blast radius is the critical assessment here, not just the CVSS score. This endpoint touches WooCommerce's database user, which has access to customer PII, order histories, and potentially stored payment tokens depending on configuration. A single unauthenticated SQL injection at this integration point becomes a mass-harvesting vector for every customer record in the store. This is fundamentally different from SQL injection in an admin-only function — the attack surface is anyone who abandons a cart, which in a active store is constant. Patch immediately. If you're running Creative Mail versions 1.6.5 through 1.6.9, upgrade to 1.6.10 or later. Because this is an unauthenticated endpoint, there's no need for credentialed access to exploit it — automated scanners will find it quickly once the CVE is public. The exposure window matters: plugins in the 1.6.x range are early-stage code receiving frequent updates, meaning this vulnerable version range likely accumulated thousands of installs before patching. Assume compromise was possible during that window. For prioritization: any WooCommerce site with Creative Mail active should treat this as emergency-priority. Even if you believe your abandoned cart volume is low, the callback fires on every abandoned cart event and the database access is broad. There's no parameter-level mitigation available — the fix must come from the plugin update. Monitor for unusual database query patterns from your WordPress database user, particularly SELECTs against wp_posts, wp_postmeta, and wp_woocommerce_session tables that you didn't initiate.

Reviewed through automated stages and approved by a human before publication.