CVE-2026-14342: SQL Injection in Mail Mint WordPress Plugin (v1.24.2 and Earlier)

Technical summary

CVE-2026-14342 is a time-based SQL injection flaw in the Mail Mint plugin's handling of the 'contact_ids' parameter. The vulnerability stems from insufficient input escaping and lack of parameterized query preparation. An attacker with administrator or higher privileges can craft malicious SQL to append additional queries to existing database statements, enabling data extraction through inference techniques. The attack surface is limited by authentication requirements but represents a privilege abuse risk when admin accounts are compromised.

Business impact

Compromise of a WordPress administrator account could lead to unauthorized extraction of sensitive business data from the site's database, including customer information, email lists, transaction records, and other confidential details stored by the Mail Mint plugin or other installed plugins. This poses direct risks to customer privacy, regulatory compliance (GDPR, CCPA), and business reputation. Data exfiltration is particularly concerning for e-commerce sites using WooCommerce with customer payment and personal information at risk.

Affected systems

WordPress installations running the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin in version 1.24.2 and earlier are affected. The vulnerability requires an authenticated user with administrator-level access or higher to exploit, meaning it primarily affects sites where admin accounts have been compromised, insiders pose a threat, or accounts are carelessly shared.

Exploitability

Exploitation requires valid WordPress administrator credentials, which significantly limits attack surface in well-secured environments. However, once those credentials are obtained through credential theft, phishing, or insider threats, exploitation is straightforward and requires no user interaction. The vulnerability is reliably exploitable through time-based inference techniques, making automated detection by skilled attackers feasible. The CVSS score of 4.9 reflects the requirement for high-privilege access but acknowledges the certainty of successful data extraction.

Remediation

Update the Mail Mint plugin to a version patched after 1.24.2 as soon as vendor patches become available. In parallel, enforce strict WordPress user access controls by limiting administrator role assignment, implementing strong password policies, enabling multi-factor authentication for admin accounts, and conducting regular access reviews. Monitor database query logs for suspicious SQL patterns and restrict admin panel access by IP address where feasible.

Patch guidance

Verify the vendor's official advisory for the specific patched version of Mail Mint. Test patches in a staging environment before deployment to production WordPress sites. Given the plugin's integration with WooCommerce and email systems, ensure compatibility with your site's current configuration. Apply the patch promptly to all affected installations, prioritizing sites handling sensitive customer or financial data.

Detection guidance

Monitor database logs for unusual SQL queries or syntax errors in queries containing the 'contact_ids' parameter. Track WordPress admin login events and administrative actions within the Mail Mint plugin interface. Deploy Web Application Firewall (WAF) rules to flag SQL injection attempts targeting common parameters. Use WordPress security plugins with database activity logging and anomaly detection capabilities. Audit plugin code and database queries if you maintain custom integrations with Mail Mint.

Why prioritize this

While the CVSS score of 4.9 reflects medium severity, the vulnerability should be prioritized based on your organization's data sensitivity and WordPress exposure. Sites handling customer payment data, personal information, or regulated content warrant immediate patching. The vulnerability's reliance on admin access provides a natural prioritization lens: assess the security posture of your WordPress administrator accounts and the likelihood of compromise in your threat environment.

Risk score, explained

The CVSS 3.1 score of 4.9 (MEDIUM) factors in: (1) Network accessibility without special conditions (AV:N/AC:L), (2) High privilege requirement reducing likelihood of exploitation (PR:H), (3) No user interaction needed (UI:N), (4) Isolated impact scope (S:U), and (5) Confidentiality impact through data extraction (C:H) with no integrity or availability impact (I:N/A:N). The high confidentiality impact is offset by the authentication barrier, yielding a moderate overall rating.

Frequently asked questions