CVE-2026-84753: CWE-502 Deserialization of Untrusted Data in WPFunnels Mail Mint

This vulnerability (CVE-2026-84753) affects WPFunnels Mail Mint versions up to 1.31.0 and involves unauthenticated PHP Object Injection due to unsafe deserialization of untrusted data (CWE-502). The vulnerability allows an attacker to remotely execute arbitrary code with no required privileges or user interaction. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including complete loss of confidentiality, integrity, and availability. Because the vulnerability is exploitable remotely without authentication or user interaction, it poses a severe risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict network access to the affected application and monitor for suspicious activity related to deserialization attempts. Avoid exposing the vulnerable service to untrusted networks.