If you received an email from me pointing you to this page, it is because your website appears to be running a version of Creative Mail by Constant Contact (the WordPress email-marketing plugin for WooCommerce, which lives in your files at /wp-content/plugins/creative-mail-by-constant-contact/) that falls within the affected range of a known security issue. This page explains what the issue is, which versions are affected, why there is no update to install, and how to remove or replace the plugin safely.

The issue is CVE-2026-3985, an unauthenticated SQL injection flaw reachable through the plugin’s WooCommerce abandoned-cart handling. It affects version 1.6.5 and every release after it, up to and including the last one the vendor published, 1.6.9.

The most important practical fact on this page: there is no fixed version to update to. The plugin was removed from the WordPress.org directory on 14 May 2026 and was never patched. The last release, 1.6.9, still carries the issue, and no newer one is coming. So this is not the usual “click update” notice. The remedy is to deactivate and remove the plugin, and if you rely on it, to replace it with a maintained alternative. The rest of this page walks through how to confirm your version and do that safely.

One point of reassurance, and it is a real one. Unlike some issues I write about, this flaw has a genuine lower bound: it was introduced in version 1.6.5. Versions 1.6.4 and earlier are not affected by it: the vulnerable code simply is not there. If your install is 1.6.4 or older, this particular issue does not apply to you. (That said, the plugin is no longer maintained by anyone, which is its own reason to plan a move off it eventually.)

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Creative Mail plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit anything to it, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the plugin publishes. I specifically did not send anything to the plugin’s checkout or consent handling, on your site or any other, and nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Creative Mail connects a WooCommerce store to Constant Contact for email marketing, and part of what it does is remember shopping carts that were started but not completed, so a store can follow up on them. That abandoned-cart handling is where this issue lives.

In affected versions, when the plugin records a checkout, one of its database lookups builds its query by pasting in a value that originates with the visitor, without using a prepared statement. The value is not escaped for use in SQL. The consequence is that a visitor who is not logged in can alter that query and read data out of your site’s database.

It is worth being precise about what this issue is and is not. It lets an attacker read data from the database. That is serious on its own, because a WordPress database holds things like user email addresses and hashed passwords, and on a store it can hold customer records. But it is not, by itself, remote code execution, a site takeover, or a way for an attacker to hand themselves an administrator account. It is narrower than the full-compromise issues I write about elsewhere, and I would rather set the scale honestly than leave you with a scarier impression than the facts support.

I am describing this at the level a site owner needs in order to act, and no further. I am not publishing the details that would let someone reproduce it, and I would ask you not to try it against your own site or anyone else’s. Reading your version number, as described below, tells you everything you need to decide what to do.

If my email cited this issue, it means the version your site reports is 1.6.5 or newer. I did not test whether your particular site is exploitable; all I observed is the version.

Am I affected?

It comes down to one question: which version of Creative Mail are you running?

From the WordPress admin area (authoritative):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Creative Mail by Constant Contact, the entry whose folder is creative-mail-by-constant-contact, and note the version shown beneath its name.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/creative-mail-by-constant-contact/readme.txt in a browser. The Stable tag: line near the top is the version your install reports, and this is the same public file I read. For this plugin I confirmed that it matches the actual released code exactly, so it is a reliable check.

One check that does not work for this plugin, so please do not rely on it. If you are used to reading a plugin’s version out of the ?ver= number attached to a script or stylesheet in your page source, that will mislead you here. On this plugin those numbers are file timestamps (long values like ?ver=1723603844), not the plugin version, and comparing one against 1.6.5 is meaningless. Use the admin screen or readme.txt.

Then apply this rule:

  • 1.6.5 or later (up to 1.6.9, the last release): affected. Because there is no fix, the step to take is to remove or replace the plugin (see below).
  • 1.6.4 or earlier: not affected by this issue. The flaw was introduced in 1.6.5, so older installs do not contain it. (The plugin is unmaintained regardless, so it is still worth planning to move off it.)

What to do: remove or replace

Because the plugin was withdrawn without a fix, there is no update to install: your WordPress dashboard will not offer one, and the version you have is the last that will ever exist. The way to close this issue is to stop running the plugin. Back up first, then remove it:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Plugins then Installed Plugins, find Creative Mail by Constant Contact, and click Deactivate. Deactivating stops the vulnerable code from running.
  3. Once deactivated, click Delete to remove the plugin’s files. If you prefer the command line, WP-CLI does the same thing: wp plugin deactivate creative-mail-by-constant-contact then wp plugin delete creative-mail-by-constant-contact.
  4. Confirm it is gone: the entry should no longer appear on the Plugins screen, and yourdomain.com/wp-content/plugins/creative-mail-by-constant-contact/readme.txt should no longer load.

If you were using Creative Mail for your store’s email marketing, you will want a replacement so you do not lose that capability. Several maintained WooCommerce email and newsletter plugins exist in the official directory; choose one that is currently supported and receiving updates. Constant Contact’s service itself is unaffected by this: the issue is in the WordPress plugin that was withdrawn, not in the email service, so if you use Constant Contact directly, a current, supported integration is the goal.

While you are in there, it is worth confirming that WordPress core and your other plugins are up to date, and removing any other plugins you no longer use.

After removing

Removing the plugin stops anything being read from your database through this issue in the future. It cannot un-read anything that may already have been read while the plugin was active on an affected version. I have no visibility into whether that happened on your site, and I did not look; most sites in the affected range have probably never been touched. But because I cannot tell you that for certain, a little precaution is reasonable, in proportion to what your database holds:

  • On a store, the sensible steps are to have your administrators change their passwords, and to be aware that customer contact details in your database could have been exposed. WordPress and WooCommerce store passwords hashed, not in plain text, but hashes of weak passwords can be cracked offline, so fresh passwords remove that worry.
  • If any plugins on your site store credentials or API keys of their own, treat those as worth rotating too.
  • Regenerating WordPress’s secret keys and salts in wp-config.php (new values are one click away at the official secret-key generator) signs all users out once and invalidates any stolen session tokens.

To be clear about the framing: this is a precaution, not a declaration that your data was taken. This notice is based on a version number, not on any evidence of an attack.

What I did and did not do

To be fully transparent about the check behind my email: I only read public files that your site already serves to every visitor, specifically the plugin’s public readme.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site.

In particular, I never sent anything to the plugin’s checkout or consent handling, on your site or anywhere else. Nothing was submitted, stored, tested, or exploited. That matters more here than on most of these pages, because that handling is the exact thing this issue concerns, so “I did not touch it” is the whole difference between a disclosure and an intrusion.

I am also deliberately not publishing the details that would help someone act on this issue. The description above stops at the level a site owner needs, and I do not link any proof-of-concept code.

This is a version-based observation: your site reports version 1.6.5 or later. A site in that range may already be protected by other means, such as a web application firewall. This notice is not a statement that your site was exploitable at the time I checked.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin