A critical SQL injection vulnerability in the Creative Mail WordPress plugin poses a severe risk of unauthorized database access.

This vulnerability is a SQL injection flaw, categorized under CWE-89. It allows an unauthenticated attacker to interact with the underlying database through malicious input.

Successful exploitation of this SQL injection vulnerability could lead to significant data compromise, as an attacker may be able to extract sensitive information from the WordPress database. Given the CVSS score of 8.6, this is a high-severity issue that could result in unauthorized access to user accounts or system configuration data, potentially leading to full site compromise.

Immediate Action: Monitor official vendor channels for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review database query logs for suspicious patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: Unknown.

Due to the high CVSS score, administrators should treat this vulnerability with urgency. If a patch is not available, consider disabling or removing the Creative Mail plugin until the vendor provides a secure version to prevent potential exploitation.