SQL Injection Vulnerability in Mail Mint Plugin for WordPress
CVE-2026-111106

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Mail Mint – Email Marketing, Automation & WooCommerce Emails With Ai Assistance
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111106?

The Mail Mint plugin for WordPress is susceptible to SQL Injection attacks through the 'filters' parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. This vulnerability arises due to inadequate escaping of user-supplied filter values before they are included in SQL queries. As a result, authenticated attackers possessing the 'mint_read_contacts' capability can manipulate existing SQL statements to extract sensitive database information. The flaw exists in versions up to and including 1.31.4, emphasizing the need for plugin updates and heightened security measures.

Affected Version(s)

Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance 0 <= 1.31.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mail-mint/tags...
https://plugins.trac.wordpress.org/browser/mail-mint/tags...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.