CVE-2026-12918 describes a second-order SQL injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin. The issue exists in all versions up to and including 1.24.1. An attacker with administrator privileges can exploit the 'recipients' parameter by submitting a specially crafted POST request to /mrm/v1/campaigns/, where the input is stored without proper sanitization due to an int-cast bypass of validation. The malicious payload is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id}, where the recipients data is deserialized and passed unsafely into an SQL query, allowing the attacker to append additional SQL commands. This can lead to unauthorized disclosure of sensitive information from the database. The CVSS v3.1 base score is 4.9, indicating a medium severity vulnerability with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official patch or remediation guidance is currently documented.

An authenticated attacker with administrator-level privileges can exploit this vulnerability to execute arbitrary SQL commands appended to existing queries. This can result in unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact data integrity or availability but compromises confidentiality. Exploitation requires high privileges and network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'recipients' parameter. Avoid exposing the vulnerable endpoints to untrusted networks. Follow vendor updates closely for any released patches or official mitigations.