CVE-2026-84755
MediumCVSS 6.5Summary
The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
Risk Assessment
The risk includes unauthorized access to data or administrative functions, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to update the Mail Mint plugin to the latest patched version immediately.
Other vulnerabilities in Mail Mint
See all- CVE-2026-84753Critical
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
- CVE-2026-12918Medium
The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.
- CVE-2026-14342Medium
The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-27349Medium
The WordPress plugin Mail Mint up to version 1.19.5 exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.