CVE-2026-111106: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance

CVE-2026-111106 is an SQL Injection vulnerability in the Mail Mint WordPress plugin (versions <=1.31.4). It occurs due to insufficient sanitization of the 'filters' parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The user input is interpolated directly into a SQL WHERE clause in a numeric context without proper escaping, and the surrounding $wpdb->prepare() calls do not cover this input. Authenticated attackers with the 'mint_read_contacts' capability can exploit this to append additional SQL queries, potentially extracting sensitive database information. The vulnerability affects versions from 0 up to and including 1.31.4. No official patch or fix information is provided in the input data.

An authenticated attacker with the 'mint_read_contacts' capability can exploit this vulnerability to perform SQL Injection, allowing them to extract sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. Since the capability is granted to Administrators by default, the risk is significant within compromised or insider threat scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the 'mint_read_contacts' capability to trusted users only and monitor for suspicious activity involving the /wp-json/mrm/v1/segments/contacts endpoint. Avoid granting this capability to lower-privileged roles. Follow vendor updates closely for an official patch.