EUVD-2026-71991
GHSA-v38w-pf7m-c3pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public Mail Mint form endpoint
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger deserialization in handle_form_submission
-
ExecutionInvoke POP gadget chain
-
PersistExecute arbitrary code on server
-
ImpactCompromise WordPress host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Mail Mint plugin (<=1.31.0, or the only-partially-patched 1.23.1) be installed and active, and that its public 'handle_form_submission' form-submission endpoint be reachable - which is the default for any published Mail Mint form. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and attack complexity is low. The exploit's power depends on the POP gadget chain shipped in the plugin/bundled libraries (posthog-php, ContactModel, FormAction); the object injection itself is unauthenticated, and code execution follows because a usable chain is present in the affected versions. The main limiting factor is version: fully-patched builds remove the vulnerable deserialization, so only sites still on <=1.31.0 (including 1.23.1) are exploitable. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is credible: object injection sits on the unauthenticated, network-reachable public form-submission handler, and a confirmed POP chain yields full C:H/I:H/A:H via code execution - this is a genuine top-priority issue, not an inflated high-CVSS number. No KEV listing and no public exploit are indicated, and EPSS was not supplied, so exploitation probability cannot be quantified from the input; however, unauthenticated PHP object injection in WordPress plugins is historically a favored, automatable target, so the absence of a published PoC should not lower urgency. One material caveat: the description states the flaw was only 'partially patched in version 1.23.1,' so operators who believe they are patched may still be exposed and should confirm they are on the fully-remediated build. Any WordPress operator running a public Mail Mint form should treat this as urgent and patch immediately. |
| Exploit ScenarioDerived | An attacker sends a crafted, unauthenticated POST to the plugin's public form-submission endpoint containing a serialized PHP object payload. The vulnerable 'handle_form_submission' function deserializes it, instantiating attacker-chosen objects whose magic methods trigger the bundled POP gadget chain, resulting in arbitrary code execution on the WordPress host. No public PoC is identified at time of analysis, but the network, no-auth, low-complexity profile makes mass automated exploitation realistic if one emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
RemediationAI
Upgrade Mail Mint to a release beyond the partial 1.23.1 fix - install the latest available version (the later remediation corresponds to trac changeset 3675453; confirm the running version is newer than 1.31.0 once the full-fix release is published), since 1.23.1 only partially closed the deserialization path. Verify remediation against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/76c073d9-9572-43e4-82eb-49adf678535b?source=cve). If immediate patching is not possible, restrict or disable the plugin's public form-submission functionality and deactivate the plugin on sites that do not need it; as a compensating control, deploy a WAF rule to block serialized-object payloads (requests containing PHP serialization markers such as 'O:' / 'a:' patterns) to the form-submission REST/AJAX endpoint, accepting that WAF signatures can be bypassed and may cause false positives on legitimate form data. Do not treat an existing 1.23.1 install as remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mail Mint is a WordPress email-marketing/newsletter and WooCommerce email-automation plugin. The root cause is CWE-502 (Deserialization of Untrusted Data): form-submission data reaching 'handle_form_submission' is passed to PHP's unserialize()-style processing without restricting allowed classes, so an attacker controls the type and properties of the resulting PHP objects. Object injection alone is inert without a gadget; here the referenced code paths (e.g. app/API/Actions/Frontend/FormAction.php, app/Database/models/ContactModel.php, and the bundled posthog-php ForkCurl consumer) supply magic methods (__wakeup/__destruct) that form a POP chain, turning object instantiation into code execution. The affected package is identified by CPE cpe:2.3:a:getwpfunnels:mail_mint_-_email_marketing,_newsletter,_email_automation_&_woocommerce_emails.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable form handler (AV:N/PR:N/UI:N/AC:L) with a confirmed POP chain yielding code execution gives full C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Mail Mint - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.
Articles & Coverage 1
Executive ViewAI
Mail Mint WordPress plugin versions up to 1.31.0 contain a critical remote code execution vulnerability that allows unauthenticated attackers to gain complete server control. Organizations running this plugin face immediate risk of data breach, service disruption, ransomware deployment, and potential compromise of connected enterprise systems.
No vendor-released patch identified at time of analysis. Immediate mitigations: disable/uninstall the plugin; require multi-factor authentication on all WordPress admin accounts; implement Web Application Firewall rules blocking requests to the affected plugin endpoint; enable comprehensive security logging and alerting on WordPress admin activities; scan all plugin directories for web shells; isolate the affected WordPress instance from sensitive internal systems; update WordPress core and all other plugins to latest versions; consider air-gapping the affected site until verification of remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB