Unauthenticated PHP Object Injection in Mail Mint by Mail Mint
CVE-2026-84753

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Mail Mint
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84753?

An unauthenticated PHP Object Injection vulnerability exists in Mail Mint versions up to 1.31.0. This flaw could potentially allow attackers to inject malicious PHP objects, which may lead to unauthorized access to the system or execution of arbitrary code, compromising website integrity and security.

Affected Version(s)

Mail Mint <= 1.31.0

References

https://patchstack.com/database/wordpress/plugin/mail-min...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

endy | Patchstack Bug Bounty Program
.