SQL Injection Vulnerability in Mail Mint Email Marketing Plugin for WordPress

CVE-2026-14342

What is CVE-2026-14342?

The Mail Mint plugin, which provides email marketing, newsletters, and automation features for WordPress, is susceptible to a time-based SQL injection exploit through the 'contact_ids' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries in versions up to and including 1.24.2. Authenticated attackers with administrator-level access can manipulate existing SQL queries to include additional commands, potentially leading to the unauthorized extraction of sensitive data from the database.

References