Executive brief
The Mail Mint email marketing plugin for WordPress contains a SQL injection vulnerability in the status parameter that allows attackers with administrator privileges to extract sensitive data from the WordPress database. While the vulnerability requires high-level access and is rated medium severity, it could enable a compromised administrator account to exfiltrate customer information, email lists, or other database contents without additional authentication.
Technical details
The vulnerability is a SQL injection flaw in the plugin's REST API endpoint that processes the 'status' parameter through insufficient escaping. The vulnerability occurs because attacker-controlled fragments are concatenated into the SQL format string before $wpdb->prepare() is called; prepare() only sanitizes %s and %d placeholders and cannot protect against content already embedded in the string. REST API JSON bodies parsed from php://input bypass WordPress's wp_magic_quotes() function, allowing unescaped double-quote characters in status array values to reach the SQL sink. Exploitation requires authenticated access with the 'mint_read_contacts' capability (a plugin-specific capability not assigned to default WordPress roles) and administrator-level access or above. A successful attack allows extraction of arbitrary data from the WordPress database.
Affected products
- Mail Mint Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails up to 1.31.0
Timeline
- 2026-09-09: disclosed