Executive brief
Mail Mint is a WordPress plugin for email marketing, newsletters, and WooCommerce integration. The plugin fails to safely validate input before deserializing PHP objects, allowing unauthenticated attackers to inject malicious code and achieve remote code execution on affected WordPress sites.
Technical details
The vulnerability is a PHP Object Injection (CWE-502) in the 'handle_form_submission' function, caused by unsafe deserialization of user-controlled input. Because the plugin processes untrusted data without validation and a gadget chain (POP chain) is available in the environment, an unauthenticated attacker can craft a malicious serialized object to achieve arbitrary code execution. The attack is network-accessible and requires no authentication or user interaction. A partial patch was issued in version 1.23.1, but the vulnerability remained exploitable in subsequent versions up to and including 1.31.0.
Affected products
- Mail Mint Mail Mint up to and including 1.31.0
Timeline
- 2026-09-05: disclosed