What is the CVSS score of CVE-2026-14342?

CVE-2026-14342 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Mail Mint CVE-2026-14342

EUVD-2026-42545 MEDIUM

SQL Injection (CWE-89)

2026-07-09 Wordfence

GHSA-r8xv-jhv9-6h7f

WordPress SQLi Wordpress Plugin Mail Mint Email Marketing Newsletter Email Automation Woocommerce Emails Getwpfunnels

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin credentials required (PR:H); time-based SQLi reads only (C:H, I:N, A:N); network-accessible admin API with no complexity barrier (AV:N, AC:L).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 09:04 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

MEDIUM 4.9

DescriptionCVE.org

The Mail Mint - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based SQL injection in the Mail Mint WordPress plugin (versions ≤1.24.2) allows authenticated administrators to extract arbitrary data from the underlying database via the unsanitized 'contact_ids' parameter in the contact management API. Reported by Wordfence, the flaw is rooted in insufficient input escaping and missing prepared statements in the ContactModel and ContactController layers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a corrective changeset (3597255) has been committed to the WordPress plugin repository.

Technical ContextAI

Mail Mint (vendor: GetWPFunnels, CPE cpe:2.3:a:getwpfunnels:mail_mint_...:*) is a WordPress email marketing and WooCommerce automation plugin. The vulnerability (CWE-89, SQL Injection) manifests specifically in three layered components: the route handler at ContactRoute.php:L475, the controller at ContactController.php:L1049, and the model query at ContactModel.php:L1159. The 'contact_ids' parameter accepted by the admin API is appended to an existing SQL query without adequate escaping or parameterized query preparation, enabling time-based blind injection. Time-based blind SQLi uses database sleep/delay functions (e.g., SLEEP() in MySQL) to infer data character-by-character through observable response timing, making it slower to exploit but fully capable of extracting schema, credentials, and all table contents.

RemediationAI

Update the Mail Mint plugin to a version beyond 1.24.2. A corrective changeset (revision 3597255) has been committed to the WordPress plugin Subversion repository, visible at https://plugins.trac.wordpress.org/changeset?reponame=&old=3597255%40mail-mint&new=3597255%40mail-mint; however, the exact released version number incorporating this fix was not confirmed in the available data - verify via the WordPress plugin directory that the installed version post-dates this changeset. As an interim workaround, restrict administrator-level WordPress role assignment to the minimum required users, since exploitation requires PR:H. Additionally, a web application firewall (WAF) rule blocking time-delay SQL patterns (e.g., SLEEP, BENCHMARK, WAITFOR) in the contact_ids parameter can reduce exposure, though this is a compensating control only and may cause false positives on legitimate bulk contact operations. Note: removing the plugin entirely eliminates the attack surface with no side effects beyond loss of Mail Mint functionality.