An authenticated SQL injection vulnerability in the Creative Mail plugin exposes the underlying database to unauthorized manipulation by low-privileged subscribers.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). Authenticated subscribers can inject malicious SQL code, which is then executed by the database, potentially exposing sensitive information.

An attacker with subscriber-level access can leverage this flaw to extract sensitive database content, including user credentials or marketing data. This represents a significant risk to data confidentiality. While the CVSS score is 8.5, the impact is highly dependent on the database permissions assigned to the web application.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate or uninstall the Creative Mail plugin until a fix is released by the vendor.

Proactive Monitoring: Enable database query logging and monitor for anomalous or highly complex SQL queries originating from the application layer.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured to inspect and block inputs containing SQL syntax to mitigate the risk of injection attacks.

Public Exploit Available: Unknown

The absence of a vendor-provided patch necessitates immediate defensive action. Organizations relying on Creative Mail should remove the plugin to eliminate the exposure until the vendor provides a secure update. Monitor vendor security bulletins closely for the release of a patched version.