An unauthenticated SQL injection vulnerability in the Creative Mail WordPress plugin poses a significant risk of unauthorized data access.

This is a SQL injection vulnerability (CWE-89) triggered by an unsanitized parameter during the management of abandoned cart emails. The vulnerability allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized access to sensitive database content.

The vulnerability carries a CVSS score of 8.6, indicating a high level of severity. Successful exploitation could lead to the exposure of sensitive customer records, internal user email addresses, and other proprietary information contained within the WordPress database. Such a compromise threatens both customer privacy and organizational reputation.

Immediate Action: Monitor the vendor advisory for a security patch and apply it as soon as it becomes available. If a fix is not immediately provided, consider disabling the plugin if the functionality is not critical to operations.

Proactive Monitoring: Review database access logs for anomalous or suspicious query patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Organizations utilizing affected versions of the Creative Mail plugin should prioritize patching as soon as the vendor releases an update to prevent potential data exfiltration.