CVE-2026-14342: Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contactids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14342?
CVE-2026-14342 has a medium severity rating of 4.9.
What type of vulnerability is identified in CVE-2026-14342?
CVE-2026-14342 is an SQL Injection vulnerability affecting the Mail Mint plugin for WordPress.
How can I fix CVE-2026-14342?
To mitigate CVE-2026-14342, update the Mail Mint plugin to version 1.24.3 or later.
What are the potential impacts of CVE-2026-14342?
CVE-2026-14342 could allow authenticated administrators to execute arbitrary SQL queries.
Is CVE-2026-14342 exploitable without authentication?
CVE-2026-14342 requires authenticated administrator access to exploit.