CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
What the vulnerability does
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
Explanation of Vulnerability in Simple Terms
Creative Mail versions 1.6.5 through 1.6.9 contain a vulnerability that allows an attacker to read sensitive information from the affected site without authentication. The vulnerability requires only network access and no user interaction. The impact extends beyond the vulnerable component itself, potentially affecting other parts of the system.
What an attacker can do
Read sensitive data from the site without logging in.
Potential impact on your site
Confidential information may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
