Arbitrary File Upload Vulnerability in Mail Mint Plugin for WordPress
CVE-2025-11967
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 November 2025
What is CVE-2025-11967?
The Mail Mint plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation in the process_contact_attribute_import function. This vulnerability affects all versions up to and including 1.18.10. Authenticated attackers with Administrator-level access can exploit this weakness, potentially allowing unauthorized file uploads to the server. Such an exploit poses serious risks, including the possibility of remote code execution, making it crucial for administrators to update to the latest version to mitigate this threat.
Affected Version(s)
Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more * <= 1.18.10