Junglewise Threat Intelligence

CVE-2026-12918: getwpfunnels Mail Mint SQL injection in recipients parameter

CVE-2026-12918 · Severity: medium · CVSS 4.9 · Published 2026-07-10

Executive brief

Mail Mint, a WordPress plugin used for email marketing and WooCommerce automation, contains a security flaw that could allow an administrator to access sensitive information from the website's database. By submitting specially crafted data through the plugin's campaign settings, an attacker can bypass security checks and run unauthorized database commands. While this requires high-level access, it could lead to the exposure of customer data or other internal site information.

Technical details

A second-order SQL injection vulnerability exists in the Mail Mint plugin due to insufficient escaping and lack of query preparation. The flaw occurs because the 'recipients' parameter in a POST request to /mrm/v1/campaigns/ bypasses filter_recipients() validation; an integer cast of a malicious string (e.g., '1) OR ...') evaluates to a valid numeric ID, allowing the payload to be stored. The injection is triggered when a subsequent GET request to /mrm/v1/campaigns/{id} deserializes the data and passes the raw string through array_column() into a vulnerable SQL query. Authenticated attackers with administrator-level privileges can leverage this to append arbitrary SQL queries and extract sensitive data from the WordPress database.

Affected products

  • getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails up to, and including, 1.24.1

Timeline

  • 2026-07-10: advisory: NVD publication date

References