CVE-2026-65547 is a SQL injection in the Creative Mail plugin for WordPress, scoring CVSS 8.5 but carrying an EPSS probability of only 0.00278. The gap between these metrics is the first thing to understand: this isn't a case where high severity and low probability cancel out. They're measuring different things, and for this vulnerability, the divergence should concern you more than either number alone.
The key context is the Subscriber privilege requirement. In most WordPress installations, Subscriber is the lowest privilege role—essentially a user who can do almost nothing. But Creative Mail is an email marketing plugin. Subscribers here aren't random site visitors; they're your mailing list contacts, the core data the plugin exists to manage. A valid Subscriber account is trivially easy to obtain (most WordPress registration forms allow it), and once you have one, this SQL injection becomes reachable. The CVSS treats Subscriber as minimal privilege, but the plugin's data model treats them as first-class users with meaningful contact information. That's your gap: technical privilege is low, but operational access is significant.
What can an attacker actually extract? This is where the note becomes speculative because the CVE details are thin, but for an email marketing plugin, assume the worst: contact names and emails, campaign content, and critically, any API tokens or integration credentials the plugin holds for connecting to external email services, CRMs, or e-commerce platforms. A SQL injection here isn't just a data breach—it's a potential pivot into every system that plugin touches. The EPSS model weighs direct exploitation signatures, not second-order data harvesting, which likely explains its low probability score.
What you should do: First, check whether Creative Mail is installed and note its version—this vulnerability affects versions up to and including 1.6.9. If it's present, update immediately; the patch exists in later versions. Second, assume the plugin holds valuable integration tokens—rotate any credentials used by connected services as a precaution. Third, monitor for unusual database query patterns from your WordPress site's user accounts, even Subscriber-level ones. Fourth, audit what data the plugin stores and what systems it connects to; the blast radius of a compromise extends far beyond the WordPress database. Finally, recognize this follows a recurring pattern: Subscriber-level SQL injection in WordPress plugins has appeared in multiple CVEs, and the low EPSS scores they receive correlate with slower remediation—a dynamic that actually preserves the threat over time.