CVE-2026-10196: Mail Mint WordPress Plugin RCE Vulnerability

CVE-2026-10196 Overview

CVE-2026-10196 is a PHP Object Injection vulnerability in the Mail Mint plugin for WordPress, an email marketing, newsletter, and WooCommerce email automation plugin. All versions up to and including 1.31.0 deserialize untrusted input inside the handle_form_submission function. Unauthenticated attackers can inject a crafted PHP object into the deserialization sink. Combined with a Property-Oriented Programming (POP) chain present in the plugin's bundled dependencies, this leads to remote code execution on the underlying server. The issue was partially patched in version 1.23.1 and is tracked as [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated remote code execution on any WordPress site running Mail Mint through version 1.31.0, enabling full site takeover.

Affected Products

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress
All versions up to and including 1.31.0
Partially patched in 1.23.1; full remediation tracked in later changesets

Discovery Timeline

2026-09-05 - CVE-2026-10196 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-10196

Vulnerability Analysis

The flaw resides in the plugin's frontend form submission handler. The handle_form_submission function in app/API/Actions/Frontend/FormAction.php passes attacker-controlled input into PHP's unserialize() routine. Because the endpoint is reachable without authentication, any anonymous visitor can submit a crafted payload. Deserializing untrusted data instantiates arbitrary PHP objects and triggers their magic methods (__wakeup, __destruct, __toString) during the process.

On its own, object instantiation is not sufficient for code execution. Mail Mint ships the posthog/posthog-php library, which contains gadget classes in vendor/posthog/posthog-php/lib/Consumer/ForkCurl.php. These gadgets form a POP chain that culminates in command execution when properties are controlled by the attacker. The ContactModel class at app/Database/models/ContactModel.php provides additional sinks reachable through the same deserialization primitive.

Root Cause

The root cause is unsafe deserialization of user-supplied input without integrity verification or type restriction. The handler does not use json_decode or the allowed_classes option of unserialize(), so any serialized PHP object is accepted and reconstructed.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP POST request to the Mail Mint form submission endpoint containing a serialized PHP object crafted from the PostHog gadget chain. Once deserialized, the chain triggers a call into ForkCurl that executes an attacker-controlled operating system command in the context of the web server user.

A sanitized proof-of-concept is not published in the referenced advisories. Technical details on the vulnerable sinks are documented in the WordPress Plugin FormAction Code, the ContactModel Code, and the PostHog ForkCurl Code.

Detection Methods for CVE-2026-10196

Indicators of Compromise

Inbound POST requests to Mail Mint REST routes containing serialized PHP payloads beginning with O: or a: sequences in form fields.
Unexpected outbound network connections or shell processes (sh, curl, wget, python) spawned by the PHP-FPM or web server process after form submissions.
New or modified PHP files under wp-content/uploads/ or wp-content/plugins/ shortly after suspicious form traffic.
Web server logs showing anonymous requests targeting handle_form_submission endpoints with unusually large request bodies.

Detection Strategies

Inspect HTTP request bodies for PHP serialization signatures reaching /wp-json/ Mail Mint routes and alert on matches from unauthenticated sessions.
Correlate WordPress access logs with process creation events on the host to detect web-server-spawned command execution.
Deploy WordPress vulnerability scanners or Wordfence rules referenced in the Wordfence Vulnerability Report to flag vulnerable Mail Mint installations.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and wp-content directories.
Forward web access logs, PHP error logs, and host process telemetry to a central SIEM for correlation.
Track outbound egress from web servers and alert on connections to unknown hosts following Mail Mint form activity.

How to Mitigate CVE-2026-10196

Immediate Actions Required

Update the Mail Mint plugin to the latest available version beyond 1.31.0 that contains the complete fix.
Audit sites for indicators of compromise, including unknown administrator accounts, injected PHP files, and scheduled tasks.
Rotate WordPress administrator passwords, database credentials, and any secrets stored in wp-config.php after patching.
Restrict access to the WordPress REST API from untrusted networks where operationally feasible.

Patch Information

The vulnerability was partially patched in Mail Mint 1.23.1. Additional remediation was applied in WordPress Changeset #3545065 and WordPress Changeset #3675453. Site owners should upgrade to the current release published on the WordPress plugin repository.

Workarounds

Temporarily deactivate and remove the Mail Mint plugin until the site can be updated to a fully patched release.
Deploy a Web Application Firewall rule that blocks requests to Mail Mint endpoints containing PHP serialization patterns such as O: followed by class-name markers.
Restrict the handle_form_submission route with server-level access controls or IP allow lists on staging and administrative environments.

bash

# Example WAF rule concept (ModSecurity) to block serialized PHP objects in Mail Mint requests
SecRule REQUEST_URI "@contains /wp-json/mint/" \
  "chain,phase:2,deny,status:403,id:1026101960,msg:'Possible CVE-2026-10196 PHP object injection'"
  SecRule REQUEST_BODY "@rx (?i)(^|&|=)O:[0-9]+:\"[A-Za-z_\\\\]+\":" "t:none,t:urlDecodeUni"