A critical SQL injection vulnerability in the Creative Mail plugin allows unauthenticated attackers to potentially extract sensitive database information.

The plugin fails to properly sanitize the 'checkout_uuid' parameter before using it in SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands, facilitating unauthorized database interaction.

Successful exploitation allows an attacker to perform unauthorized database queries, which may lead to the exfiltration of sensitive site data, including customer information and configuration details. Given the CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality and should be addressed as a priority to prevent potential regulatory and reputational damage.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the Creative Mail plugin until a fix is released by the vendor.

Proactive Monitoring: Review database query logs for anomalous activity, specifically looking for unexpected SQL syntax or patterns targeting the 'checkout_uuid' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns, which may provide temporary protection against exploitation attempts.

Public Exploit Available: No (exploit_available: false)

The absence of a patch necessitates immediate defensive action. Administrators are urged to prioritize the removal of this plugin to eliminate the attack surface, as SQL injection remains a primary vector for data breaches in WordPress environments.