CVE-2025-47541: Mail Mint Information Disclosure Flaw

CVE-2025-47541 Overview

CVE-2025-47541 is a sensitive information disclosure vulnerability in the WPFunnels Mail Mint plugin for WordPress. The flaw affects all versions of Mail Mint up to and including 1.17.7. An unauthenticated remote attacker can retrieve embedded sensitive data sent by the application over the network. The vulnerability is classified under [CWE-201: Insertion of Sensitive Information Into Sent Data]. Successful exploitation impacts data confidentiality without requiring user interaction or authentication. The issue stems from the plugin including sensitive information in data transmitted to unintended parties.

Critical Impact

Unauthenticated attackers can retrieve sensitive embedded data from Mail Mint, exposing confidential information stored or processed by the WordPress plugin.

Affected Products

• WPFunnels Mail Mint plugin for WordPress
• All versions from initial release through 1.17.7
• WordPress sites running the mail-mint plugin

Discovery Timeline

• 2025-05-23 - CVE CVE-2025-47541 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-47541

Vulnerability Analysis

The vulnerability is categorized as [CWE-201: Insertion of Sensitive Information Into Sent Data]. Mail Mint embeds sensitive data within outbound responses or transmitted content where it should not be exposed. An attacker reaching the affected endpoints over the network can read this data without authentication.

The attack vector is network-based with low complexity. No privileges or user interaction are required. Exploitation impacts confidentiality but does not directly affect integrity or availability of the host system. The EPSS probability is 0.307%, placing the CVE in the 53.9th percentile of likely-exploited vulnerabilities.

Root Cause

The root cause is improper handling of sensitive information during data transmission within the Mail Mint plugin. The plugin embeds confidential values, such as configuration data, user information, or internal identifiers, in responses accessible to unauthenticated requesters. The vendor advisory hosted on Patchstack documents the affected behavior up to version 1.17.7.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site running a vulnerable Mail Mint version. The plugin responds with content containing embedded sensitive information. Because authentication is not required, exposure is possible from any network-reachable client. No exploit code is publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-47541

Indicators of Compromise

• Unauthenticated HTTP requests targeting Mail Mint REST API routes under /wp-json/mailmint/ or /wp-json/mrm/
• Outbound responses from the WordPress site containing fields such as API keys, contact records, or internal identifiers returned to anonymous callers
• Web server logs showing repeated GET requests to Mail Mint endpoints from a single source IP

Detection Strategies

• Inventory WordPress installations and confirm the installed mail-mint plugin version against 1.17.7 and earlier
• Inspect HTTP responses from Mail Mint endpoints for inclusion of sensitive fields that should not be returned to unauthenticated callers
• Correlate web access logs with WordPress plugin telemetry to identify anomalous enumeration of Mail Mint routes

Monitoring Recommendations

• Enable verbose logging on the WordPress REST API and forward logs to a central SIEM for correlation
• Alert on unauthenticated access to plugin-specific REST endpoints from non-administrative IP ranges
• Track plugin version drift across managed WordPress sites and flag instances pinned at vulnerable releases

How to Mitigate CVE-2025-47541

Immediate Actions Required

• Update the Mail Mint plugin to a version newer than 1.17.7 once a patched release is available from WPFunnels
• Audit Mail Mint configuration and rotate any API keys, tokens, or credentials managed by the plugin that may have been exposed
• Restrict access to the WordPress REST API for unauthenticated users where the application does not require public endpoints

Patch Information

The Patchstack Vulnerability Report tracks this issue and lists the affected range as Mail Mint up to and including 1.17.7. Administrators should consult the vendor advisory and upgrade to the fixed release as soon as it becomes available.

Workarounds

• Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to Mail Mint REST endpoints until the plugin is updated
• Disable or uninstall the Mail Mint plugin if it is not in active use
• Place the WordPress administration interface behind an authentication proxy or IP allowlist to reduce exposure of plugin endpoints