Mail Mint CVE-2026-84755

No special authentication or privilege is required - the CVSS vector PR:N/UI:N confirms unauthenticated, interaction-free exploitation. The target system must be running WordPress with the Mail Mint plugin installed and active at version 1.31.0 or earlier. The vulnerable endpoint(s) must be network-reachable; if the WordPress REST API or AJAX handlers are blocked for anonymous users at the server level, exploitation would be prevented. No specific non-default configuration is named in the advisory as a prerequisite - this appears to affect default plugin installations. Exploitation is limited to partial confidentiality and integrity impact (C:L/I:L); full site takeover is not indicated by the available data.

The CVSS 3.1 base score of 6.5 with AV:N/AC:L/PR:N/UI:N represents a straightforward network-exploitable, zero-prerequisite flaw, but the limited impact (C:L/I:L/A:N) caps real-world severity. No EPSS score was provided in the input; no KEV listing and no POC are noted, suggesting this has not yet seen opportunistic mass exploitation. For sites using Mail Mint - particularly those processing subscriber data or managing outbound email campaigns - unauthorized read/write of marketing data (subscriber lists, opt-in settings, campaign content) carries meaningful business risk even without full compromise. The absence of any privilege or interaction requirement makes automated scanning trivial, raising automatable risk despite the moderate score. Organizations running the plugin should treat this as an elevated-priority patch given the unauthenticated attack surface, even though the raw CVSS does not reach critical threshold.

An unauthenticated attacker identifies a WordPress site running Mail Mint ≤1.31.0 via passive reconnaissance (e.g., plugin enumeration). The attacker sends a crafted HTTP request directly to the vulnerable REST API endpoint or AJAX handler, bypassing all authorization checks, and reads subscriber data or modifies campaign settings without possessing any WordPress credentials. No public exploit code exists at time of analysis, but the low complexity and zero-prerequisite nature make manual exploitation straightforward for any competent attacker.