Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111106— Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter

Quick assessment

Affected
getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Mail Mint 插件在 1.31.4 及更早版本中存在 SQL 注入漏洞。该漏洞源于 REST API 端点的 参数未对用户提供的过滤条件值（ ）进行充分转义。具体而言，在 方法的第 797 行，该值以字符串插值方式被嵌入到 SQL 查询的 WHERE 子句中，且处于数值（未加引号）的上下文中；同时，周围调用的 函数未能覆盖该注入值。 这使得拥有自定义 权限的已认证攻击者（默认授予管理员角色，也可通过插件的角色管理器配置授予更低权限角色）能够在现有查询中追加额外的 SQL 语句，从而从数

CVSS 6.5 · Medium EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance ≤ 1.31.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111106

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance 0 ~ 1.31.4 -

II. Public POCs for CVE-2026-111106

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111106

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111106 (1)

Vendor Pages for CVE-2026-111106 (1)

Other References for CVE-2026-111106 (2)

IV. Related Vulnerabilities

Same vendor: getwpfunnels
Same weakness: CWE-89

V. Comments for CVE-2026-111106

No comments yet

Leave a comment