Mail Mint CVE-2026-14342

Exploitation requires an authenticated session with WordPress administrator-level privileges or above (PR:H per CVSS), meaning the attacker must either possess valid admin credentials, have compromised an administrator account, or operate as a malicious insider with admin rights. The vulnerable code path is triggered specifically through the 'contact_ids' parameter in the Mail Mint admin contact management API (ContactRoute.php:L475). No additional non-default configuration is required - the vulnerable parameter is part of standard plugin functionality available to any administrator. Exploitation is limited to confidentiality impact only (time-based read); no write capability is exposed. The attack is network-accessible (AV:N) from any remote origin with no user interaction required beyond the attacker's own authenticated requests.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) yields a medium score of 4.9, which accurately captures the primary limiting factor: exploitation requires administrator-level WordPress credentials (PR:H). An attacker who already holds admin access has numerous simpler paths to data exfiltration - direct database access via admin tools, file system read through plugin editors, etc. - so the marginal uplift of this SQLi path is low in post-compromise scenarios. The C:H rating reflects that full database read is theoretically possible, but I:N and A:N confirm the time-based technique provides no write or denial capability. No EPSS data was provided; given the high privilege requirement and niche plugin footprint, real-world exploitation probability is expected to be low. No KEV listing and no identified public POC further reduce urgency. The primary concern would be a compromised or malicious admin account, or in rare multi-tenant setups where role separation between admin tiers matters.

An attacker with administrator credentials authenticates to a WordPress site running Mail Mint ≤1.24.2, then sends a crafted POST request to the admin contact API endpoint with a malicious contact_ids payload embedding a time-delay SQL expression. By measuring response latency for true/false conditions, the attacker iterates through database contents - extracting WordPress user table hashes, WooCommerce order data, or subscriber PII - character by character. No public POC has been identified, but the source code references confirm the vulnerable code paths are trivially locatable.