CVE-2026-1447 describes a CSRF vulnerability in the Mail Mint plugin for WordPress, affecting all versions up to 1.19.2. The root cause is missing nonce validation on the create_or_update_note function, enabling attackers to perform unauthorized create or update actions on contact notes if an administrator is tricked into clicking a malicious link. The vulnerability is compounded by missing sanitization and escaping, which can result in stored XSS attacks. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction, with low impact on confidentiality and integrity and no impact on availability.

An attacker can exploit this vulnerability to create or update contact notes in the Mail Mint plugin by tricking an administrator into performing an action. This can lead to stored Cross-Site Scripting, potentially allowing execution of malicious scripts in the context of the administrator's browser. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the web server or application firewall level. Monitor vendor channels for updates and apply patches promptly once released.