CVE-2025-11967 is a high-severity vulnerability in the Mail Mint plugin for WordPress (versions up to 1.18.10) caused by the lack of file type validation in the process_contact_attribute_import function. This allows authenticated users with administrator privileges to upload arbitrary files to the server, potentially leading to remote code execution. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). There is no vendor-provided patch or advisory available at this time, and no known exploits have been reported in the wild.

An attacker with administrator-level access can upload arbitrary files to the server hosting the vulnerable Mail Mint plugin, which may result in remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.2, reflecting the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious file uploads. Avoid using the vulnerable versions of the plugin in production environments where possible.