CVE-2026-1258 Overview
CVE-2026-1258 is a blind SQL Injection vulnerability in the Mail Mint plugin for WordPress affecting all versions up to and including 1.19.2. The flaw resides in the forms, automation, email/templates, and contacts/import/tutorlms/map API endpoints. Insufficient escaping on the user-supplied order-by, order-type, and selectedCourses parameters, combined with a lack of proper query preparation, allows authenticated attackers with administrator-level access to append additional SQL queries to existing ones. The issue is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can extract sensitive database contents through time-based blind SQL injection across four vulnerable API endpoints.
Affected Products
- Mail Mint plugin for WordPress, all versions up to and including 1.19.2
- WordPress installations with Mail Mint plugin enabled
- Sites where untrusted users hold administrator-level roles
Discovery Timeline
- 2026-02-14 - CVE-2026-1258 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1258
Vulnerability Analysis
The Mail Mint plugin exposes several REST API actions that build SQL queries from request parameters without parameterized binding. The vulnerable code paths reside in TemplateAction.php, FormModel.php, AutomationStore.php, and Import.php. Each accepts user input that is concatenated directly into SQL statements executed against the WordPress database.
Because the injection is blind, the server does not return query output in HTTP responses. Attackers infer database contents through boolean conditions or time-delay payloads such as SLEEP() calls injected into the ORDER BY clause. Successful exploitation enables extraction of WordPress credentials, session tokens, API keys, and any subscriber data stored by Mail Mint.
The attack requires administrator privileges, which limits exposure to scenarios involving compromised admin accounts, malicious insiders, or multi-admin sites where role separation is weak.
Root Cause
The root cause is improper neutralization of special characters in SQL statements. The order-by, order-type, and selectedCourses parameters flow into raw query strings without $wpdb->prepare() placeholders or whitelist validation. The ORDER BY clause cannot be parameterized using standard placeholders, so the plugin must validate these values against a fixed allowlist — which it failed to do prior to the fix.
Attack Vector
An authenticated attacker sends crafted requests to one of the vulnerable Mail Mint REST endpoints, supplying SQL payloads in the order-by, order-type, or selectedCourses parameters. The injected SQL executes within the WordPress database context. Repeated boolean or time-based queries reconstruct table contents byte by byte.
No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Report and the corresponding WordPress plugin changeset.
Detection Methods for CVE-2026-1258
Indicators of Compromise
- Unexpected wp-json/mailmint/ or Mail Mint REST API calls containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in order-by, order-type, or selectedCourses parameters.
- Elevated database query latency correlated with administrator session activity on Mail Mint endpoints.
- Web server access logs showing repeated requests to forms, automation, email/templates, or contacts/import/tutorlms/map endpoints with anomalous query string lengths.
Detection Strategies
- Inspect WordPress audit logs for authenticated administrator requests issuing rapid sequential calls to Mail Mint API actions.
- Deploy a Web Application Firewall (WAF) rule that flags SQL meta-characters in the order-by, order-type, and selectedCourses parameters.
- Enable MySQL or MariaDB general query logging temporarily to identify queries containing concatenated ORDER BY payloads sourced from PHP code paths in Mail Mint.
Monitoring Recommendations
- Alert on administrator account logins from new geographies or user agents preceding Mail Mint API activity.
- Baseline normal Mail Mint API request volume and trigger anomaly detections on sustained spikes.
- Monitor for outbound data egress from the WordPress host following suspicious admin sessions.
How to Mitigate CVE-2026-1258
Immediate Actions Required
- Update the Mail Mint plugin to a release later than 1.19.2 that incorporates changeset 3449536.
- Audit all WordPress administrator accounts and remove any unused or over-privileged roles.
- Enforce strong, unique passwords and multi-factor authentication for every administrator account.
Patch Information
The vendor addressed the issue in the Mail Mint codebase via changeset 3449536, which adds input validation and proper query preparation across TemplateAction.php, FormModel.php, AutomationStore.php, and Import.php. Site operators should upgrade to the fixed Mail Mint release through the WordPress plugin updater.
Workarounds
- Temporarily disable the Mail Mint plugin until the patched version is deployed.
- Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF layer.
- Apply a virtual patching rule in the WAF to reject requests where order-by, order-type, or selectedCourses contain non-alphanumeric characters.
# Configuration example - update Mail Mint via WP-CLI
wp plugin update mail-mint --version=latest
wp plugin status mail-mint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
