---
title: "Creative Mail Vulnerability: No Patch Is Coming, Ever"
slug: "creative-mail-sql-injection-cve-2026-3985"
description: "An unauthenticated Creative Mail vulnerability (CVE-2026-3985) exposes your database. The plugin is discontinued, so removal is the only fix."
date: 2026-09-14
author: "WP Vanguard Team"
category: "Research"
tags: ["creative-mail-vulnerability", "cve-2026-3985", "sql-injection", "unauthenticated-vulnerability", "woocommerce-security"]
featured_image: "/images/blog/creative-mail-sql-injection-cve-2026-3985.jpg"
---

Creative Mail, an email marketing plugin Constant Contact built for WordPress and WooCommerce stores, has an unauthenticated SQL injection with a CVSS score of 7.5 and no fixed version. CVE-2026-3985 lets an attacker append SQL to a query through the `checkout_uuid` parameter without logging in first. That would be bad enough on its own. What makes the Creative Mail vulnerability different from a normal patch-and-move-on bug is timing: Constant Contact had already discontinued the plugin, and WordPress.org had already closed its listing, before the CVE became public. There is no maintainer left to ship a fix.

We verified the plugin's status directly against its WordPress.org listing and its own source code rather than repeating the discontinuation date and install count that circulated after disclosure. Some of those numbers turned out to be wrong. Here's what we can confirm, and what removal actually involves once you check the plugin's code for what it leaves behind.

## Inside the Creative Mail Vulnerability

The bug sits in `DatabaseManager::has_checkout_consent()`, a method Creative Mail's abandoned-cart feature calls to check whether a guest shopper agreed to marketing emails during checkout. We pulled the plugin's 1.6.9 source from the WordPress.org SVN repository to see the query directly:

```php
$consent_value = $wpdb->get_var(
    $wpdb->prepare("SELECT checkout_consent FROM {$table_name} WHERE checkout_uuid = '{$checkout_uuid}'")
);
```

That call to `$wpdb->prepare()` looks like the right defense, but it's doing nothing. The `checkout_uuid` value is already interpolated into the string before `prepare()` ever sees it, and there are no placeholders or bound arguments for `prepare()` to substitute. It's a no-op wrapped around an already-vulnerable query, which matches Wordfence's description of "insufficient preparation of the existing SQL query" almost exactly.

Reaching that code doesn't require a login. Creative Mail's abandoned-cart flow reads a `ce4wp-recover` value from an incoming request and stores it as `checkout_uuid` in the WooCommerce guest session. A guest shopper, meaning anyone who loads the checkout page, can then trigger an AJAX action that runs `has_checkout_consent()` against that stored value. The nonce involved belongs to the public checkout flow, not an authenticated WordPress session, so it does nothing to gate access. Researcher Dmitrii Ignatyev reported the flaw with a working proof of concept on February 25, 2026; Wordfence published it as CVE-2026-3985 on May 19, 2026.

The precondition is that a site has abandoned-cart management and WooCommerce's classic checkout both enabled, which is a common combination for stores that installed Creative Mail specifically to recover abandoned carts. Sites running only the block-based checkout, or that never turned on abandoned-cart tracking, aren't reachable through this exact path.

## Why Creative Mail Won't Get Patched

Constant Contact didn't go quiet on this plugin by accident. Jetpack's own resource page states plainly: "Starting January 2026, Creative Mail will be permanently discontinued," and recommends MailPoet as the replacement. WordPress.org closed the plugin's listing on May 14, 2026, five days before the CVE went public, and the closure reason it displays is "Security Issue." Put the two dates together and the picture is clear. The vendor stopped supporting the plugin months before this vulnerability surfaced, and the directory pulled it the moment the report came in, with nobody positioned to ship a fix in between.

That's a different flavor of no-patch situation than a slow vendor or an unresponsive developer. It's a plugin whose company already told its users to move on, followed by a vulnerability disclosure that arrived too late to change anything. We've written before about what to do when the fix simply isn't coming; our [WP Learn Manager writeup](/blog/wp-learn-manager-arbitrary-plugin-install-cve-2026-12153) covers the deactivate-versus-delete decision for a plugin whose WordPress.org listing closed before a critical bug was even disclosed, and the same logic applies here: deactivating stops the immediate exposure, but only deleting removes the risk that someone reactivates it later.

## How Many Sites Are Exposed

Because the plugin's listing is closed, WordPress.org's own install counter no longer serves a live number, and the plugin API returns nothing for the slug. We checked two independent third-party mirrors of the plugin's last cached WordPress.org data, WPHive and WPCore, and both report 300,000 active installations at version 1.6.9. That figure appears to have been sitting in these caches since before closure. WPCore's snapshot shows the plugin's last real update was roughly 860 days before its own crawl, meaning it went a couple of years without a functional release before Constant Contact discontinued it.

We're flagging the install count because an earlier estimate that circulated for this CVE put the figure at 500,000, a number that doesn't match anything we could independently verify. The 21.8 million figure a couple of research sites list is total lifetime downloads, not active sites, and it's easy to mistake one for the other.

Exploitation looks limited so far. The vulnerability isn't in CISA's Known Exploited Vulnerabilities catalog, our own exploitation database doesn't list it, and the EPSS model puts the odds of exploitation in the next 30 days at 0.4 percent, a low score. A proof of concept exists, but no source we checked reports an active exploit in the wild. Low current exploitation isn't the same as low risk, though. Unauthenticated SQL injection in an abandoned plugin is exactly the kind of bug that gets picked up in an automated scanning campaign months after everyone stopped paying attention to it, the pattern our [look at how WordPress sites actually get hacked](/blog/how-wordpress-sites-get-hacked) covers in more general terms.

## Removing Creative Mail the Right Way

Back up your database before touching anything, then deactivate and delete the plugin through WP-CLI:

```bash
wp db export creative-mail-removal-backup.sql
wp plugin deactivate creative-mail-by-constant-contact
wp plugin delete creative-mail-by-constant-contact
```

Deactivating alone already helps: Creative Mail's own deactivation routine clears two of its options, `ce4wp_activated` and `ce4wp_install_date`, from `wp_options`. But we checked the plugin's full source for an `uninstall.php` file, and there isn't one. That means `wp plugin delete` removes the plugin's files and nothing in your database. Two custom tables Creative Mail creates on activation, `ce4wp_abandoned_checkout` and `ce4wp_contacts` (behind your table prefix, `wp_` by default), stay behind indefinitely, along with a handful of leftover options (`ce4wp_activation_redirect`, `ce4wp_admin_footer_text_rated`, `ce4wp_ignore_review_notice`).

Check what's actually there before you drop anything:

```bash
wp db query "SHOW TABLES LIKE '%ce4wp%'"
wp option list --search="ce4wp*"
```

The backup you took covers those tables. If you're confident you don't need the abandoned-cart data, clean up with the commands below. `wp db prefix` fills in your site's table prefix, so they work whether or not you use the default `wp_`:

```bash
wp db query "DROP TABLE IF EXISTS $(wp db prefix)ce4wp_abandoned_checkout"
wp db query "DROP TABLE IF EXISTS $(wp db prefix)ce4wp_contacts"
wp option delete ce4wp_activation_redirect ce4wp_admin_footer_text_rated ce4wp_ignore_review_notice
```

## What to Check After You Remove It

If your store had abandoned-cart management and classic checkout both switched on before you removed Creative Mail, it's worth a closer look at your access logs for `checkout_uuid` values that don't look like ordinary UUIDs, particularly ones containing quote characters, `UNION`, `SLEEP(`, or other SQL syntax. That's consistent with the time-based injection technique this bug allows. Our general [signs your WordPress site has been hacked](/blog/signs-wordpress-site-hacked) checklist covers the broader indicators worth reviewing alongside that: unfamiliar admin accounts, unexpected database users, and modified core or plugin files.

If you're replacing Creative Mail's WooCommerce email features, Jetpack's own guidance points to MailPoet as the maintained successor. Whatever you choose, treat it the way you'd treat any plugin handling customer checkout data going forward. Our [WooCommerce security guide](/blog/wordpress-security-woocommerce) covers the baseline checks worth running on any store plugin that touches carts and customer records, and it's a reasonable second read once Creative Mail is off the site. If you want to confirm Creative Mail (or any other abandoned plugin) is really gone and check the rest of your install for known vulnerabilities at the same time, [run a free scan with WP Vanguard](/#scanner).

## References

- [WordPress.org: Creative Mail Plugin Page (Closed, "Security Issue")](https://wordpress.org/plugins/creative-mail-by-constant-contact/)
- [CleanTalk PSC: CVE-2026-3985, Creative Mail Unauthenticated SQL Injection](https://research.cleantalk.org/cve-2026-3985/)
- [Freshysites Security Bulletin: CVE-2026-3985](https://freshysites.com/security-bulletins/creative-mail-easier-wordpress-woocommerce-email-marketing-plugin-vulnerability-cve-2026-3985/)
- [Strix CVE Database: CVE-2026-3985](https://www.strix.ai/cve/CVE-2026-3985)
- [WPScan: Creative Mail 1.6.5 - 1.6.9 Unauthenticated SQLi](https://wpscan.com/vulnerability/eb2f34bd-c626-4831-a886-c82882073bcd/)
- [Jetpack: Introducing Creative Mail for Jetpack (discontinuation notice)](https://jetpack.com/resources/introducing-creative-mail-for-jetpack/)
- [WPCore: Creative Mail Plugin Listing (installs, downloads, changelog)](https://wpcore.com/plugin/creative-mail-by-constant-contact)