CVE-2026-111106
MediumCVSS 6.5Summary
The Mail Mint plugin for WordPress in versions up to and including 1.31.4 is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. Insufficient escaping of the user-supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797 — the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value.
Risk Assessment
An authenticated attacker with the 'mint_read_contacts' capability (granted to Administrators by default, configurable to lower roles) can append additional SQL queries and extract sensitive information from the database.
Recommendation
Update the Mail Mint plugin to a version later than 1.31.4. Restrict the 'mint_read_contacts' capability to the minimum necessary.
Other vulnerabilities in Mail Mint
See all- CVE-2026-84753Critical
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
- CVE-2026-19800Medium
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to 1.31.0. Authenticated attackers with administrator-level access can append SQL queries to extract sensitive information. The vulnerability is due to insufficient query preparation and JSON parsing bypassing WordPress protections.
- CVE-2026-84755Medium
The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
- CVE-2026-12918Medium
The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.
- CVE-2026-14342Medium
The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-27349Medium
The WordPress plugin Mail Mint up to version 1.19.5 exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS