CVE-2026-14342 is a time-based SQL Injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin by getwpfunnels. The issue arises from improper neutralization of special elements in the 'contact_ids' parameter, allowing authenticated administrators to append malicious SQL commands to existing queries. This occurs due to insufficient escaping of user input and lack of prepared statements, enabling extraction of sensitive data from the database. The vulnerability affects all versions up to and including 1.24.2. No vendor advisory or patch is currently available.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks that disclose sensitive information from the database. The vulnerability does not affect system availability or integrity but compromises confidentiality. The attack requires authenticated high-privilege access, limiting the attack surface to trusted users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL query manipulation in the plugin. Avoid using vulnerable versions in sensitive environments if possible.