CVE-2026-14342 describes a time-based SQL Injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin by getwpfunnels. The flaw exists in all versions up to and including 1.24.2, where the 'contact_ids' parameter is not properly escaped and the SQL query is not sufficiently prepared. This allows authenticated attackers with administrator privileges to append malicious SQL commands to existing queries, potentially exposing sensitive database information. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting medium severity. No vendor advisory or patch information is currently available.

An attacker with administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond the described data exposure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'contact_ids' parameter. Avoid using vulnerable versions of the plugin if possible.