Mail Mint CVE-2026-111106

Requires an authenticated WordPress account holding the plugin-specific 'mint_read_contacts' capability, which is granted only to Administrators by default but can be delegated to lower-privileged roles through Mail Mint's built-in role manager. Exploitation is performed against the /wp-json/mrm/v1/segments/contacts REST endpoint by supplying a malicious filter 'value' that lands in an unquoted numeric SQL context not covered by $wpdb->prepare(). The principal limiting factor is this capability requirement: in a default configuration the attacker must already be an Administrator (making the practical impact low), whereas the realistic risk arises specifically on sites that have reassigned 'mint_read_contacts' to lower roles. No special user interaction is needed, and the plugin must be at version 1.31.4 or earlier.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 6.5 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: network-reachable REST endpoint, low attack complexity, and a confidentiality-only impact (data extraction via SQLi) with no integrity or availability effect. The key risk-limiting signal is PR:L - exploitation requires an authenticated account holding the custom 'mint_read_contacts' capability, which by default is only granted to Administrators. The real-world risk therefore hinges on whether a site operator has used the plugin's role manager to extend that capability to lower-privileged roles; in default deployments the attacker would already need admin-equivalent access, sharply reducing practical severity, whereas in reconfigured deployments a low-privileged user could read arbitrary database contents. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code - exploitation status is therefore 'no public exploit identified at time of analysis.' The vendor-assigned Medium rating looks appropriate and is not an inflated high-CVSS-but-low-risk case.

An attacker who holds (or has been granted) the 'mint_read_contacts' capability sends a crafted request to the /wp-json/mrm/v1/segments/contacts REST endpoint with a malicious 'filters' value. Because the value is string-interpolated into an unquoted numeric context in SegmentFilterService::get_meta_join_query() outside the protection of $wpdb->prepare(), the attacker appends a UNION/sub-query to exfiltrate data such as password hashes or other sensitive table contents. No public exploit code was identified at time of analysis, but the vulnerable source line is publicly disclosed.