CVE-2026-12918 describes a second-order SQL injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin. The issue exists in the 'recipients' parameter, which is insufficiently sanitized before being incorporated into SQL queries. An attacker with administrator privileges can submit a specially crafted payload via a POST request to /mrm/v1/campaigns/, bypassing input validation due to an integer cast that converts malicious strings into valid numeric IDs. This payload is stored unsanitized and later triggered by a GET request to /mrm/v1/campaigns/{id}, where the recipients data is deserialized and used directly in a vulnerable SQL query. This allows the attacker to append additional SQL commands to extract sensitive information from the database. The vulnerability affects all versions up to and including 1.24.1.

An authenticated attacker with administrator-level access can exploit this vulnerability to perform SQL injection attacks, enabling unauthorized extraction of sensitive database information. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure (no integrity or availability impact is indicated).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the affected endpoints.