WordPress Mail Mint Plugin Authenticated SQL Injection (CVE-2026-12918)

Vulnerability Overview Vulnerability Name: Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter CVE ID: CVE-2026-12918 CVSS Score: 4.9 (Medium) Publication Date: July 9, 2026 Last Updated: July 10, 2026 Researchers: PRISM Affected Software Software Type: Plugin Software Name: Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails Affected Versions: <= 1.24.1 Fixed Version: 1.24.2 Remediation Recommendation: Upgrade to version 1.24.2 or later. Vulnerability Description A SQL injection vulnerability exists in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin up to version 1.24.1. This vulnerability is triggered via the 'recipients' parameter due to insufficient escaping and parameterization of user-supplied input, allowing SQL queries to be tampered with. Attackers can exploit this vulnerability to execute arbitrary SQL commands, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N Related Vulnerabilities: - CVE-2026-14342: Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter - CVE-2026-27349: Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure - CVE-2026-2025: Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more <= 1.19.5 - Unauthenticated Information Disclosure - CVE-2026-23541: Mail Mint <= 1.19.4 - Missing Authorization - CVE-2026-1258: Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints - CVE-2026-1447: Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting - CVE-2025-11967: Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload - CVE-2025-59570: Mail Mint <= 1.18.6 - Authenticated (Administrator+) SQL Injection - CVE-2025-58604: Mail Mint <= 1.18.5 - Authenticated (Administrator+) SQL Injection - CVE-2025-47541: Mail Mint <= 1.17.7 - Unauthenticated Sensitive Information Exposure Notes For detailed information and remediation guidance, please refer to the Wordfence Intelligence database. For more information, visit Wordfence Intelligence.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Mail Mint Plugin Authenticated SQL Injection (CVE-2026-12918)

More from this source