CVE-2026-27349
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WordPress plugin Mail Mint up to version 1.19.5 exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Risk Assessment
An attacker may access confidential system data such as API keys, passwords, or other configuration data, potentially leading to further attacks.
Recommendation
Update the Mail Mint plugin to the latest available version. Restrict access to sensitive data through proper authorization mechanisms.
Other vulnerabilities in Mail Mint
See all- CVE-2026-84753Critical
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
- CVE-2026-19800Medium
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to 1.31.0. Authenticated attackers with administrator-level access can append SQL queries to extract sensitive information. The vulnerability is due to insufficient query preparation and JSON parsing bypassing WordPress protections.
- CVE-2026-84755Medium
The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
- CVE-2026-12918Medium
The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.
- CVE-2026-14342Medium
The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS