CVE-2026-84753
CriticalCVSS 9.8Summary
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
Risk Assessment
An unauthenticated attacker could exploit this to execute arbitrary code on the server, potentially compromising the website and its data.
Recommendation
Immediately update the Mail Mint plugin to the latest patched version.
Other vulnerabilities in Mail Mint
See all- CVE-2026-84755Medium
The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
- CVE-2026-12918Medium
The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.
- CVE-2026-14342Medium
The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-27349Medium
The WordPress plugin Mail Mint up to version 1.19.5 exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.