CVE-2026-1258: Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1258?
CVE-2026-1258 is considered a critical vulnerability due to its potential for authenticated SQL Injection attacks that could compromise database integrity.
How do I fix CVE-2026-1258?
To fix CVE-2026-1258, update the Mail Mint plugin to version 1.19.3 or later, which addresses the SQL Injection issue.
Who is affected by CVE-2026-1258?
Users of Mail Mint plugin versions 1.19.2 and earlier on WordPress sites are affected by CVE-2026-1258.
What types of attacks can be executed through CVE-2026-1258?
CVE-2026-1258 allows for blind SQL Injection attacks that can lead to unauthorized access to sensitive data stored in the database.
Which API endpoints are vulnerable in CVE-2026-1258?
CVE-2026-1258 affects multiple API endpoints, including 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map'.