CVE-2025-11967: Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload
The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the processcontactattributeimport function in all versions up to, and including, 1.18.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11967?
CVE-2025-11967 is classified as a high severity vulnerability due to the ability for authenticated users to exploit arbitrary file uploads.
How do I fix CVE-2025-11967?
To fix CVE-2025-11967, update the Mail Mint plugin to version 1.18.11 or later.
Who is affected by CVE-2025-11967?
CVE-2025-11967 affects all versions of the Mail Mint plugin for WordPress prior to version 1.18.11.
What is the impact of CVE-2025-11967?
The impact of CVE-2025-11967 allows attackers to potentially upload malicious files that can compromise the web server.
Is authentication required to exploit CVE-2025-11967?
Yes, exploitation of CVE-2025-11967 requires authenticated access with Administrator-level permissions.