What is the CVSS score of CVE-2026-23541?

CVE-2026-23541 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mail Mint are affected by CVE-2026-23541?

WPFunnels Mail Mint WordPress plugin (versions ≤1.19.4) contains a broken access-control vulnerability exposing sensitive customer and business data to unauthenticated attackers.

How to fix or mitigate CVE-2026-23541?

Within 24 hours, audit all WordPress installations to identify sites running WPFunnels Mail Mint plugin and document the version currently in use. Within 7 days, either disable and remove the plugin if business requirements allow, or upgrade to the latest available version if released by the vendor; verify patches against official WPFunnels security advisories and test in staging before production deployment. Within 30 days, establish automated monitoring for WPFunnels security advisories and implement a policy to deploy confirmed patches or deploy interim controls within 48 hours of vendor release.

Mail Mint CVE-2026-23541

HIGH

Missing Authorization (CWE-862)

2026-02-19 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Missing authorization on a network-reachable plugin endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only data exposure, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 09:16 cve.org

HIGH 7.5

CVE Published

Feb 19, 2026 - 09:16 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

AnalysisAI

Sensitive information disclosure in the WPFunnels Mail Mint WordPress plugin (versions up to and including 1.19.4) allows remote unauthenticated attackers to reach functionality that is not properly constrained by access-control lists, exposing confidentiality-impacting data. The flaw is a broken access control / missing authorization weakness reported by Patchstack. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, so real-world exploitation pressure is currently minimal despite the high CVSS of 7.5.

Technical ContextAI

Mail Mint is an email marketing, automation, and CRM plugin for WordPress used to manage contacts, campaigns, and automation workflows. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints - typically WordPress AJAX actions or REST API routes registered by the plugin - execute privileged functionality without verifying the caller's capability or authentication state. In WordPress plugins this class of bug commonly arises when a handler omits current_user_can() capability checks or nonce/permission callbacks, so any visitor can invoke actions intended only for authenticated administrators or marketing operators. Given the CVSS impact profile (C:H, I:N, A:N), the exposed functionality primarily leaks confidential data (e.g., contact lists, subscriber details, or campaign data) rather than allowing modification or disruption.

Affected ProductsAI

The affected product is WPFunnels Mail Mint (plugin slug mail-mint) for WordPress, affected from an unspecified earliest version through and including 1.19.4. No CPE string was provided in the input. The authoritative advisory is the Patchstack database entry: https://patchstack.com/database/Wordpress/Plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-19-4-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

No vendor-released patch version is identified in the provided data; the advisory only bounds the vulnerable range at <= 1.19.4, so administrators should upgrade Mail Mint to the latest available release newer than 1.19.4 and confirm the fixed version via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-19-4-broken-access-control-vulnerability?_s_id=cve) and the WordPress.org plugin changelog before deploying. Until a confirmed fixed version is applied, compensating controls include deploying a WordPress WAF or virtual patch (Patchstack/Wordfence rules) to block requests to the vulnerable plugin endpoints, and restricting access to wp-admin/admin-ajax.php and the plugin's REST routes at the reverse proxy or firewall to known IPs where feasible - noting that restricting admin-ajax.php can break legitimate front-end AJAX for other plugins and should be tested. If the plugin is not actively used, deactivating and removing it eliminates the exposure entirely, at the cost of losing email-automation functionality.