Mail Mint Email Marketing Newsletter Email Automation Woocommerce Emails
Monthly
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Time-based SQL injection in the Mail Mint WordPress plugin (versions ≤1.24.2) allows authenticated administrators to extract arbitrary data from the underlying database via the unsanitized 'contact_ids' parameter in the contact management API. Reported by Wordfence, the flaw is rooted in insufficient input escaping and missing prepared statements in the ContactModel and ContactController layers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a corrective changeset (3597255) has been committed to the WordPress plugin repository.
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Time-based SQL injection in the Mail Mint WordPress plugin (versions ≤1.24.2) allows authenticated administrators to extract arbitrary data from the underlying database via the unsanitized 'contact_ids' parameter in the contact management API. Reported by Wordfence, the flaw is rooted in insufficient input escaping and missing prepared statements in the ContactModel and ContactController layers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a corrective changeset (3597255) has been committed to the WordPress plugin repository.