The vulnerability identified as CVE-2026-23541 affects WPFunnels Mail Mint versions up to 1.19.4. It is characterized by missing authorization checks, allowing unauthenticated remote attackers to access functionality that is not properly constrained by access control lists (ACLs). The CVSS 3.1 base score is 7.5, reflecting a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

An attacker can remotely access sensitive functionality in Mail Mint without authentication or authorization, potentially leading to unauthorized disclosure of sensitive information. The vulnerability does not impact integrity or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected Mail Mint installation to trusted networks or users to reduce exposure.