Creative Mail Vulnerability: No Patch Is Coming, Ever

Creative Mail, an email marketing plugin Constant Contact built for WordPress and WooCommerce stores, has an unauthenticated SQL injection with a CVSS score of 7.5 and no fixed version. CVE-2026-3985 lets an attacker append SQL to a query through the checkout_uuid parameter without logging in first. That would be bad enough on its own. What makes the Creative Mail vulnerability different from a normal patch-and-move-on bug is timing: Constant Contact had already discontinued the plugin, and WordPress.org had already closed its listing, before the CVE became public. There is no maintainer left to ship a fix.

We verified the plugin's status directly against its WordPress.org listing and its own source code rather than repeating the discontinuation date and install count that circulated after disclosure. Some of those numbers turned out to be wrong. Here's what we can confirm, and what removal actually involves once you check the plugin's code for what it leaves behind.

Inside the Creative Mail Vulnerability

The bug sits in DatabaseManager::has_checkout_consent(), a method Creative Mail's abandoned-cart feature calls to check whether a guest shopper agreed to marketing emails during checkout. We pulled the plugin's 1.6.9 source from the WordPress.org SVN repository to see the query directly:

$consent_value = $wpdb->get_var(
    $wpdb->prepare("SELECT checkout_consent FROM {$table_name} WHERE checkout_uuid = '{$checkout_uuid}'")
);

That call to $wpdb->prepare() looks like the right defense, but it's doing nothing. The checkout_uuid value is already interpolated into the string before prepare() ever sees it, and there are no placeholders or bound arguments for prepare() to substitute. It's a no-op wrapped around an already-vulnerable query, which matches Wordfence's description of "insufficient preparation of the existing SQL query" almost exactly.

Reaching that code doesn't require a login. Creative Mail's abandoned-cart flow reads a ce4wp-recover value from an incoming request and stores it as checkout_uuid in the WooCommerce guest session. A guest shopper, meaning anyone who loads the checkout page, can then trigger an AJAX action that runs has_checkout_consent() against that stored value. The nonce involved belongs to the public checkout flow, not an authenticated WordPress session, so it does nothing to gate access. Researcher Dmitrii Ignatyev reported the flaw with a working proof of concept on February 25, 2026; Wordfence published it as CVE-2026-3985 on May 19, 2026.

The precondition is that a site has abandoned-cart management and WooCommerce's classic checkout both enabled, which is a common combination for stores that installed Creative Mail specifically to recover abandoned carts. Sites running only the block-based checkout, or that never turned on abandoned-cart tracking, aren't reachable through this exact path.

Why Creative Mail Won't Get Patched

Constant Contact didn't go quiet on this plugin by accident. Jetpack's own resource page states plainly: "Starting January 2026, Creative Mail will be permanently discontinued," and recommends MailPoet as the replacement. WordPress.org closed the plugin's listing on May 14, 2026, five days before the CVE went public, and the closure reason it displays is "Security Issue." Put the two dates together and the picture is clear. The vendor stopped supporting the plugin months before this vulnerability surfaced, and the directory pulled it the moment the report came in, with nobody positioned to ship a fix in between.

That's a different flavor of no-patch situation than a slow vendor or an unresponsive developer. It's a plugin whose company already told its users to move on, followed by a vulnerability disclosure that arrived too late to change anything. We've written before about what to do when the fix simply isn't coming; our WP Learn Manager writeup covers the deactivate-versus-delete decision for a plugin whose WordPress.org listing closed before a critical bug was even disclosed, and the same logic applies here: deactivating stops the immediate exposure, but only deleting removes the risk that someone reactivates it later.

How Many Sites Are Exposed

Because the plugin's listing is closed, WordPress.org's own install counter no longer serves a live number, and the plugin API returns nothing for the slug. We checked two independent third-party mirrors of the plugin's last cached WordPress.org data, WPHive and WPCore, and both report 300,000 active installations at version 1.6.9. That figure appears to have been sitting in these caches since before closure. WPCore's snapshot shows the plugin's last real update was roughly 860 days before its own crawl, meaning it went a couple of years without a functional release before Constant Contact discontinued it.

We're flagging the install count because an earlier estimate that circulated for this CVE put the figure at 500,000, a number that doesn't match anything we could independently verify. The 21.8 million figure a couple of research sites list is total lifetime downloads, not active sites, and it's easy to mistake one for the other.

Exploitation looks limited so far. The vulnerability isn't in CISA's Known Exploited Vulnerabilities catalog, our own exploitation database doesn't list it, and the EPSS model puts the odds of exploitation in the next 30 days at 0.4 percent, a low score. A proof of concept exists, but no source we checked reports an active exploit in the wild. Low current exploitation isn't the same as low risk, though. Unauthenticated SQL injection in an abandoned plugin is exactly the kind of bug that gets picked up in an automated scanning campaign months after everyone stopped paying attention to it, the pattern our look at how WordPress sites actually get hacked covers in more general terms.

Removing Creative Mail the Right Way

Back up your database before touching anything, then deactivate and delete the plugin through WP-CLI:

wp db export creative-mail-removal-backup.sql
wp plugin deactivate creative-mail-by-constant-contact
wp plugin delete creative-mail-by-constant-contact

Deactivating alone already helps: Creative Mail's own deactivation routine clears two of its options, ce4wp_activated and ce4wp_install_date, from wp_options. But we checked the plugin's full source for an uninstall.php file, and there isn't one. That means wp plugin delete removes the plugin's files and nothing in your database. Two custom tables Creative Mail creates on activation, ce4wp_abandoned_checkout and ce4wp_contacts (behind your table prefix, wp_ by default), stay behind indefinitely, along with a handful of leftover options (ce4wp_activation_redirect, ce4wp_admin_footer_text_rated, ce4wp_ignore_review_notice).

Check what's actually there before you drop anything:

wp db query "SHOW TABLES LIKE '%ce4wp%'"
wp option list --search="ce4wp*"

The backup you took covers those tables. If you're confident you don't need the abandoned-cart data, clean up with the commands below. wp db prefix fills in your site's table prefix, so they work whether or not you use the default wp_:

wp db query "DROP TABLE IF EXISTS $(wp db prefix)ce4wp_abandoned_checkout"
wp db query "DROP TABLE IF EXISTS $(wp db prefix)ce4wp_contacts"
wp option delete ce4wp_activation_redirect ce4wp_admin_footer_text_rated ce4wp_ignore_review_notice

What to Check After You Remove It

If your store had abandoned-cart management and classic checkout both switched on before you removed Creative Mail, it's worth a closer look at your access logs for checkout_uuid values that don't look like ordinary UUIDs, particularly ones containing quote characters, UNION, SLEEP(, or other SQL syntax. That's consistent with the time-based injection technique this bug allows. Our general signs your WordPress site has been hacked checklist covers the broader indicators worth reviewing alongside that: unfamiliar admin accounts, unexpected database users, and modified core or plugin files.

If you're replacing Creative Mail's WooCommerce email features, Jetpack's own guidance points to MailPoet as the maintained successor. Whatever you choose, treat it the way you'd treat any plugin handling customer checkout data going forward. Our WooCommerce security guide covers the baseline checks worth running on any store plugin that touches carts and customer records, and it's a reasonable second read once Creative Mail is off the site. If you want to confirm Creative Mail (or any other abandoned plugin) is really gone and check the rest of your install for known vulnerabilities at the same time, run a free scan with WP Vanguard.

References

• WordPress.org: Creative Mail Plugin Page (Closed, "Security Issue")
• CleanTalk PSC: CVE-2026-3985, Creative Mail Unauthenticated SQL Injection
• Freshysites Security Bulletin: CVE-2026-3985
• Strix CVE Database: CVE-2026-3985
• WPScan: Creative Mail 1.6.5 - 1.6.9 Unauthenticated SQLi
• Jetpack: Introducing Creative Mail for Jetpack (discontinuation notice)
• WPCore: Creative Mail Plugin Listing (installs, downloads, changelog)