CVE-2025-11967: Mail Mint WordPress Plugin RCE Vulnerability

CVE-2025-11967 Overview

CVE-2025-11967 is an arbitrary file upload vulnerability in the Mail Mint plugin for WordPress. The flaw affects all versions up to and including 1.18.10. It exists in the process_contact_attribute_import function, which fails to validate file types during contact attribute imports. Authenticated attackers holding Administrator-level access or higher can upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected WordPress site. The issue is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated administrators can upload executable files through the Mail Mint contact import function, potentially achieving remote code execution and full site compromise.

Affected Products

Mail Mint plugin for WordPress, versions up to and including 1.18.10
Fixed in Mail Mint version 1.18.11
WordPress sites running the vulnerable Mail Mint plugin with administrator accounts

Discovery Timeline

2025-11-08 - CVE-2025-11967 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11967

Vulnerability Analysis

The vulnerability resides in the process_contact_attribute_import function inside app/API/Actions/Admin/Contact/ContactImportAction.php. The function accepts uploaded files used to import contact attributes but does not verify the file type, extension, or MIME content before writing to disk. An attacker can submit a request containing a PHP file or another executable artifact disguised as an import payload. Once placed in a web-accessible directory, the attacker can request the file and trigger code execution under the web server user. The vulnerability requires Administrator privileges, which limits remote exploitation but enables full server compromise when admin credentials are stolen, leaked, or abused by an insider.

Root Cause

The root cause is missing file type validation in the import handler. The function trusts client-supplied input and skips allowlist checks on file extension and MIME type. The fix in version 1.18.11 introduces validation logic in the updated ContactImportAction.php to restrict acceptable file formats.

Attack Vector

An authenticated administrator sends a crafted multipart upload to the Mail Mint contact import endpoint. The payload is a server-side script with a permissive extension or content type. The plugin writes the file to a path the web server can serve. The attacker then requests the file URL to execute arbitrary code in the WordPress process context. Refer to the Wordfence vulnerability analysis for additional context on the exploitation path.

Detection Methods for CVE-2025-11967

Indicators of Compromise

New or unexpected files with .php, .phtml, or other executable extensions inside Mail Mint upload directories or wp-content/uploads/
POST requests to Mail Mint contact import REST endpoints followed by direct GET requests to newly created files
WordPress administrator sessions originating from unfamiliar IP addresses immediately before file uploads
Web server process spawning shell utilities such as sh, bash, python, or curl after a Mail Mint import

Detection Strategies

Hunt for write operations from PHP-FPM or Apache processes that produce script files in wp-content/uploads/ and related Mail Mint paths
Alert on HTTP requests to Mail Mint import endpoints that include attachments with non-CSV content types
Correlate WordPress audit logs showing administrator activity with file system creation events on the underlying host

Monitoring Recommendations

Enable WordPress activity logging for administrator account actions, especially plugin-driven imports
Forward web server access logs and file integrity monitoring events to a centralized SIEM or data lake for correlation
Monitor outbound network connections from the WordPress host for reverse shells or unexpected callbacks following import activity

How to Mitigate CVE-2025-11967

Immediate Actions Required

Upgrade the Mail Mint plugin to version 1.18.11 or later on every WordPress site in the environment
Audit administrator accounts, rotate credentials, and enforce multi-factor authentication for all privileged WordPress users
Review wp-content/uploads/ and Mail Mint directories for unauthorized files created before patching
Inspect web server and WordPress logs for signs of prior exploitation, especially file uploads followed by direct script execution

Patch Information

The vendor addressed the vulnerability in Mail Mint version 1.18.11. The patch adds file type validation inside the process_contact_attribute_import function. Source code changes are visible in the WordPress plugin changeset 3389643.

Workarounds

Temporarily deactivate the Mail Mint plugin until the patched version is installed
Restrict administrator access to the WordPress backend using IP allowlisting at the web server or WAF layer
Configure the web server to deny execution of PHP files within wp-content/uploads/ and other writable directories
Apply a web application firewall rule that blocks non-CSV file types submitted to Mail Mint import endpoints

bash

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}