CVE-2026-19800: Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contactfilterquery fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wpmagicquotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mintreadcontacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an administrator, making this effectively an Administrator+ vulnerability.
Affected Software
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
An attacker must be authenticated and have administrator-level access or higher, as well as the plugin-specific mint_read_contacts capability. That capability is not assigned to any default WordPress role and must have been explicitly granted.
Are standard WordPress administrator accounts affected by default?
Not necessarily. Although administrator-level access is required, exploitation also depends on mint_read_contacts being explicitly assigned; it is not granted to default WordPress roles.
What could an attacker obtain through successful exploitation?
A successful attacker can append SQL queries to existing queries and extract sensitive information from the WordPress database. The issue affects the status parameter processed through REST API JSON request bodies.