CVE-2026-19800: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wp_magic_quotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mint_read_contacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an administrator, making this effectively an Administrator+ vulnerability.
AI Analysis
Technical Summary
CVE-2026-19800 describes an SQL Injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin. The flaw exists in all versions up to and including 1.31.0 due to insufficient escaping of the 'status' parameter. The vulnerability arises because the $wpdb->prepare() function does not sanitize SQL fragments concatenated into the query string before execution, allowing injection of additional SQL commands. The REST API JSON input bypasses WordPress's wp_magic_quotes(), allowing unescaped double quotes to reach the SQL query. Exploitation requires the 'mint_read_contacts' capability, which is a plugin-specific privilege granted only explicitly by an administrator, making this an Administrator+ level vulnerability. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.
Potential Impact
An authenticated attacker with administrator-level privileges or higher, possessing the 'mint_read_contacts' capability, can exploit this vulnerability to inject arbitrary SQL commands. This can lead to unauthorized disclosure of sensitive information from the database. There is no indication of integrity or availability impact. The vulnerability does not affect users without the required capability, limiting the attack surface.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the 'mint_read_contacts' capability strictly to trusted administrators. Monitor for updates from the plugin vendor and apply any official patches promptly once released.
CVE-2026-19800: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Description
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wp_magic_quotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mint_read_contacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an administrator, making this effectively an Administrator+ vulnerability.
CVSS v3.1
Score 4.9medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19800 describes an SQL Injection vulnerability in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails WordPress plugin. The flaw exists in all versions up to and including 1.31.0 due to insufficient escaping of the 'status' parameter. The vulnerability arises because the $wpdb->prepare() function does not sanitize SQL fragments concatenated into the query string before execution, allowing injection of additional SQL commands. The REST API JSON input bypasses WordPress's wp_magic_quotes(), allowing unescaped double quotes to reach the SQL query. Exploitation requires the 'mint_read_contacts' capability, which is a plugin-specific privilege granted only explicitly by an administrator, making this an Administrator+ level vulnerability. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.
Potential Impact
An authenticated attacker with administrator-level privileges or higher, possessing the 'mint_read_contacts' capability, can exploit this vulnerability to inject arbitrary SQL commands. This can lead to unauthorized disclosure of sensitive information from the database. There is no indication of integrity or availability impact. The vulnerability does not affect users without the required capability, limiting the attack surface.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the 'mint_read_contacts' capability strictly to trusted administrators. Monitor for updates from the plugin vendor and apply any official patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-13T20:25:42.090Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa0d80cacd9273b49ac6fc0
Added to database: 09/09/2026, 03:52:44 UTC
Last enriched: 09/09/2026, 04:08:06 UTC
Last updated: 09/09/2026, 23:16:13 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.