EUVD-2026-70589
GHSA-28vg-wv39-3g8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Mail Mint ≤1.31.0
-
DeliveryCraft serialized PHP object payload
-
ExploitSend to vulnerable unauthenticated endpoint
-
ExecutionPlugin calls unserialize() on input
-
PersistPOP gadget chain triggered during deserialization
-
ImpactArbitrary file/DB/code operations on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to a WordPress site with the Mail Mint plugin (WPFunnels) at version 1.31.0 or earlier installed and active - no authentication, no user interaction, and no non-default configuration are needed to inject the malicious serialized object (PR:N/UI:N). The key limiting factor is escalation: converting the object injection into concrete file, database, or code-execution impact depends on a usable POP gadget chain existing in the loaded PHP codebase (the plugin itself, WordPress core, or another installed plugin); on installations lacking such a gadget the realized impact is reduced. There is no version/platform restriction beyond the vulnerable plugin version range. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction - a strong theoretical priority. However, the full C:H/I:H/A:H impact is contingent on a usable POP gadget chain being present; where none exists the practical impact can be substantially lower, so the 9.8 should be read as a worst-case rating. No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active or automated exploitation yet - treat this as high-severity-by-potential rather than confirmed-under-attack. Because the vulnerable surface is unauthenticated and internet-facing on WordPress sites, defenders should prioritize patching despite the missing exploitation signals. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to an internet-facing WordPress site running Mail Mint <= 1.31.0, embedding a serialized PHP object in a parameter that the plugin passes to unserialize(). When a matching gadget chain in the plugin, WordPress core, or another installed plugin is triggered during deserialization, the attacker achieves file write, deletion, SQL injection, or remote code execution without authentication. No public POC is identified at time of analysis, but the flaw's unauthenticated network reach makes it an attractive mass-scanning target once details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade Mail Mint to a fixed release above 1.31.0 as soon as the vendor publishes one - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-31-0-php-object-injection-vulnerability) is the authoritative reference; no exact fixed version is confirmed in the provided data, so verify the patched version on the plugin's changelog before deploying. Until a patched version is installed, compensating controls include deactivating and removing the Mail Mint plugin (trade-off: disables all email campaigns and automations), placing a WAF or Patchstack virtual patch in front of the site to block serialized-object payloads targeting the plugin's endpoints (trade-off: may miss obfuscated payloads), and restricting or authenticating access to the affected request handlers at the web-server level where feasible. Removing or hardening other plugins that expose known POP gadget chains also reduces the chance that object injection can be escalated to code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mail Mint is a WordPress email marketing and automation plugin (CPE cpe:2.3:a:wpfunnels:mail_mint) used for campaigns, contact lists, and funnels. The root cause is CWE-502 (Deserialization of Untrusted Data): attacker-controlled input reaches PHP's unserialize() without validation, letting an attacker instantiate arbitrary PHP objects. On its own, object injection is only dangerous when a 'POP' (Property-Oriented Programming) gadget chain - a class with exploitable magic methods such as __destruct(), __wakeup(), or __toString() - is reachable in the loaded codebase; the extensive WordPress plugin/theme ecosystem frequently supplies such gadgets, which is why Patchstack treats these as high impact.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization with no user interaction; retain C/I/A:H as worst-case given commonly-available POP gadget chains in the WordPress ecosystem.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
Articles & Coverage 1
Executive ViewAI
Organizations running Mail Mint email-marketing plugin for WordPress versions 1.31.0 or earlier face an unauthenticated remote code execution vulnerability with no vendor patch available, allowing attackers to compromise WordPress installations and steal customer email data. This impacts any organization using the plugin for email marketing, posing immediate data breach and operational continuity risks. Although no public exploit has been identified at time of analysis, the CVSS 9.8 critical severity and unauthenticated attack vector demand immediate remediation action.
Deactivate or uninstall Mail Mint plugin immediately; restrict network access to affected WordPress installations using firewall and Web Application Firewall (WAF) rules to block requests targeting plugin functionality; enable logging and alerting on PHP deserialization attempts and suspicious POST requests; restrict plugin file permissions and disable unnecessary PHP functions if technically feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB