CVE-2026-10196: CWE-502 Deserialization of Untrusted Data in getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

CVE-2026-10196 is a critical vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin. It involves PHP Object Injection through unsafe deserialization of untrusted data in the 'handle_form_submission' function. This flaw allows unauthenticated attackers to inject malicious PHP objects. The presence of a POP (Property Oriented Programming) chain enables attackers to achieve remote code execution on the server. Although a partial patch was applied in version 1.23.1, versions up to and including 1.31.0 remain vulnerable. No official full remediation or patch is confirmed in the provided data.

Successful exploitation can lead to remote code execution with no authentication required, resulting in full compromise of the affected server. Confidentiality, integrity, and availability of the system are all severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was applied in version 1.23.1, but versions up to 1.31.0 remain vulnerable. Users should monitor the vendor's official channels for a complete fix and apply updates once available. Until then, consider disabling or restricting access to the vulnerable functionality if possible.