Mail Mint CVE-2026-19800

Exploitation requires two concurrent prerequisites: (1) the attacker must be authenticated with WordPress administrator-level access (PR:H), and (2) the attacker's account must hold the plugin-specific 'mint_read_contacts' capability, which is absent from all default WordPress roles (administrator, editor, author, contributor, subscriber) and must be explicitly granted by a site administrator. The Mail Mint plugin must also be installed and active on the target site. What limits exploitation: the combination of required administrator authentication and a non-default, explicitly-delegated plugin capability narrows the attacker population to insiders or adversaries who have already achieved administrator-level compromise through a separate attack - external unauthenticated network attackers cannot reach the vulnerable code path under any default configuration.

Real-world risk is substantially lower than a raw CWE-89 label implies. The CVSS 3.1 score of 4.9 (PR:H) accurately reflects the elevated privilege bar: exploitation requires both active WordPress administrator credentials and the plugin-specific 'mint_read_contacts' capability, which is never assigned to any default WordPress role and must be explicitly delegated by a site administrator. In practice, even a mid-sized WooCommerce operator in sanok would find the realistic attacker population confined to trusted site administrators or to adversaries who have already compromised an administrator account through a separate vector, positioning this as an insider-threat or post-compromise escalation concern rather than an externally-driven attack. No EPSS score is present in the input data, and the vulnerability does not appear in CISA KEV, consistent with the high privilege bar and absence of public exploit code. The confidentiality impact is genuine - stacked SQL queries could expose the full WordPress database including contact records, credentials, and configuration data - but integrity and availability are unaffected per the CVSS vector. Patching is appropriate at next maintenance cycle for most deployments; urgency rises only where administrator accounts are shared, weakly secured, or accessible to untrusted parties.

An attacker who has obtained WordPress administrator credentials - via phishing, credential stuffing, or a shared-account compromise - and whose account has been granted the plugin-specific 'mint_read_contacts' capability crafts a REST API request to the Mail Mint ContactRoute endpoint with a SQL-injected value in the JSON 'status' array field. Because the request body is consumed from php://input (bypassing wp_magic_quotes()), the injected SQL fragment passes unescaped into the ContactModel query builder, where it is concatenated into the format string before prepare() executes, allowing stacked queries that extract arbitrary table data from the WordPress database. No public proof-of-concept exploit has been identified at time of analysis.