CVE-2026-14342
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.
Risk Assessment
An authenticated attacker with administrator-level access can inject additional SQL queries, potentially extracting sensitive information from the database, such as passwords or user data.
Recommendation
Immediately update the Mail Mint plugin to the latest available version that fixes this vulnerability. If an update is not available, restrict access to the WordPress admin panel to trusted users only.
Other vulnerabilities in Mail Mint
See all- CVE-2026-12918Medium
The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.
- CVE-2026-27349Medium
The WordPress plugin Mail Mint up to version 1.19.5 exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.