EUVD-2026-42862
GHSA-87jw-g834-7wpg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator authentication confirmed as prerequisite (PR:H); network-delivered REST API (AV:N); confidentiality-only impact with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Mail Mint - Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to generic SQL Injection via the 'recipients' parameter in all versions up to, and including, 1.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the malicious payload is first stored unsanitized via a POST request to /mrm/v1/campaigns/ (bypassing filter_recipients() validation because an int-cast of a string like '1) OR ...' evaluates to a real numeric ID), and is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id} that deserializes the recipients and passes the raw id string through array_column() into the vulnerable query.
AnalysisAI
Second-order SQL injection in Mail Mint WordPress plugin (all versions ≤ 1.24.1) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database via the 'recipients' parameter in the campaign REST API. The attack exploits a two-stage flaw: a malicious SQL payload bypasses int-cast input validation at write time and persists unsanitized, then fires during a subsequent campaign retrieval request that passes the raw value into an unparameterized query. No public exploit or CISA KEV listing has been identified at time of analysis; real-world risk is moderated by the required administrator-level authentication.
Technical ContextAI
The vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) is rooted in a classic second-order injection pattern across Mail Mint's campaign REST API. On the write path, POST /mrm/v1/campaigns/ accepts a 'recipients' parameter that is validated by filter_recipients() using a PHP int-cast - a payload such as '1) OR 1=1--' casts to integer 1, passes the numeric check, and is stored in the database without further sanitization (CampaignController.php L304). On the read path, GET /mrm/v1/campaigns/{id} deserializes the stored recipients value, passes it through PHP's array_column() function, and feeds the raw string into a SQL query in ContactGroupPivotModel.php (L130) that lacks prepared-statement parameterization. Supporting logic in CampaignController.php (L1088) and MrmCommon.php (L1197) is also implicated. All affected source is confirmed at the WordPress plugin SVN repository under the 1.24.1 tag. No CPE string was explicitly provided in the input data.
RemediationAI
Update Mail Mint to the version introduced in the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3592458%40mail-mint&new=3592458%40mail-mint - note that the exact patched release version number is not explicitly stated in available data and should be confirmed via the WordPress plugin directory before deploying. If immediate patching is not feasible, restrict WordPress administrator accounts to the minimum necessary trusted users and audit existing admin-level accounts for unauthorized access, as this is the sole exploitation prerequisite. A WAF rule blocking SQL keywords (UNION, SELECT, OR, AND combined with numeric-pattern payloads) in POST body parameters targeting /mrm/v1/campaigns/ can serve as a compensating control, though WAF bypasses for second-order injections are well-documented and this should not substitute for patching. Database activity monitoring on the WordPress database can provide detection capability for anomalous SELECT patterns originating from the plugin's queries.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today