CVE-2026-111106: Mail Mint WordPress Plugin SQL Injection

CVE-2026-111106 Overview

CVE-2026-111106 is a SQL Injection vulnerability in the Mail Mint plugin for WordPress affecting all versions up to and including 1.31.4. The flaw resides in the /wp-json/mrm/v1/segments/contacts REST endpoint, where the filters parameter is insufficiently sanitized before being appended to a SQL query in SegmentFilterService::get_meta_join_query(). Authenticated attackers holding the mint_read_contacts capability can append additional SQL queries to extract sensitive data from the WordPress database. The capability is granted to Administrators by default, but site owners can delegate it to lower roles through the plugin's role manager, expanding the pool of potential attackers.

Critical Impact
Authenticated users with the mint_read_contacts capability can execute arbitrary SQL queries and exfiltrate sensitive data from the WordPress database, including user credentials, session tokens, and private contact records.

Affected Products

Mail Mint plugin for WordPress, versions up to and including 1.31.4
WordPress installations exposing the /wp-json/mrm/v1/segments/contacts REST route
Sites that delegate the mint_read_contacts capability to non-administrator roles

Discovery Timeline

2026-10-16 - CVE-2026-111106 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111106

Vulnerability Analysis

The vulnerability is a classic SQL Injection [CWE-89] triggered through the REST API surface of the Mail Mint plugin. The SegmentController registered under SegmentRoute accepts a user-supplied filters array describing segmentation criteria for contacts. When the controller delegates filter evaluation to SegmentFilterService, the service builds a dynamic SQL fragment that joins post meta tables to apply the requested criteria. At line 797 of SegmentFilterService.php, the filter value is interpolated directly into the WHERE fragment using PHP string formatting in a numeric, unquoted context. The surrounding calls to $wpdb->prepare() do not bind the attacker-controlled portion of the expression, so adversary input flows unchanged into the final query dispatched to MySQL.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The developer relied on $wpdb->prepare() for other segments of the query but assumed the filter value was numeric and did not cast or bind it. Because WordPress does not type-coerce REST parameters unless explicitly configured, an authenticated client can supply a string containing SQL operators that the database parser executes as part of the composed statement.

Attack Vector

An authenticated attacker holding the mint_read_contacts capability sends a crafted POST or GET request to /wp-json/mrm/v1/segments/contacts with a malicious filters[value] payload. Because the value is interpolated in a numeric position, attackers can break out of the expected integer context using boolean, UNION, or time-based payloads. The result is unauthorized read access to database tables including wp_users and wp_usermeta. Refer to the Wordfence Vulnerability Report and the vulnerable function in Mail Mint Segment Filter Service #797 for technical details.

Detection Methods for CVE-2026-111106

Indicators of Compromise

Unexpected POST or GET requests to /wp-json/mrm/v1/segments/contacts containing SQL metacharacters such as UNION, SLEEP(, BENCHMARK(, or information_schema inside the filters parameter.
Elevated query latency on the WordPress MySQL backend coinciding with REST traffic to the Mail Mint endpoint.
MySQL error log entries referencing syntax errors in queries emitted by SegmentFilterService::get_meta_join_query.

Detection Strategies

Inspect HTTP access logs for authenticated requests to the Mail Mint segments endpoint where the filters parameter contains non-numeric characters or SQL keywords.
Enable MySQL general query logging in staging to baseline legitimate segment filter queries and alert on structural deviation in production.
Review WordPress user and role audit logs for unexpected assignments of the mint_read_contacts capability to non-administrator roles.

Monitoring Recommendations

Deploy a web application firewall rule that blocks SQL metacharacters in the filters[value] field of the /wp-json/mrm/v1/* namespace.
Monitor REST authentication events for low-privileged accounts invoking segmentation routes outside normal workflows.
Track outbound database query volume per authenticated session and alert on anomalous data egress patterns.

How to Mitigate CVE-2026-111106

Immediate Actions Required

Upgrade the Mail Mint plugin to a version newer than 1.31.4 that includes the fix from Mail Mint Changeset #3743638.
Audit the plugin's role manager and revoke the mint_read_contacts capability from any role that does not require it.
Rotate WordPress administrator passwords and API keys if the plugin was exposed to untrusted authenticated users.

Patch Information

The vendor addressed the vulnerability in the Mail Mint trunk through changeset 3743638, which modifies SegmentFilterService.php to properly escape or bind the user-supplied filter value before it reaches $wpdb->prepare(). Site administrators should update through the WordPress plugin manager or by deploying the patched release package directly. Confirm the installed version is greater than 1.31.4 after update.

Workarounds

Temporarily restrict the mint_read_contacts capability to trusted administrators only until the patched version is deployed.
Block external access to /wp-json/mrm/v1/segments/contacts at the reverse proxy or WAF layer for IP ranges that do not require plugin administration.
Disable the Mail Mint plugin on production sites that cannot immediately upgrade and do not actively use the segmentation feature.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in the filters value
SecRule REQUEST_URI "@beginsWith /wp-json/mrm/v1/segments/contacts" \
  "id:1026111106,phase:2,deny,status:403,\
   chain,msg:'Possible CVE-2026-111106 SQLi attempt against Mail Mint'"
  SecRule ARGS:'filters[value]' "@rx (?i)(union|select|sleep|benchmark|information_schema|--|/\*)" \
    "t:none,t:urlDecodeUni"