CVE-2026-12918: Mail Mint WordPress Plugin SQLi Flaw

CVE-2026-12918 Overview

CVE-2026-12918 is a second-order SQL injection vulnerability in the Mail Mint WordPress plugin, an email marketing, newsletter, and WooCommerce email automation tool. The flaw affects all versions up to and including 1.24.1 and exists in the handling of the recipients parameter within the campaigns REST API. Authenticated attackers with administrator-level access can inject arbitrary SQL fragments that extract sensitive database contents. The vulnerability is classified as [CWE-89] SQL Injection and stems from insufficient escaping combined with unprepared SQL query construction.

Critical Impact
Authenticated administrators can extract sensitive information from the WordPress database, including user credentials, session tokens, and confidential campaign data via crafted recipients payloads.

Affected Products

Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress
All versions up to and including 1.24.1
WordPress sites with Mail Mint installed and active

Discovery Timeline

2026-07-10 - CVE-2026-12918 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-12918

Vulnerability Analysis

The vulnerability is a second-order SQL injection, meaning the malicious payload is stored during one request and executed during a subsequent request. An attacker first submits a POST request to /mrm/v1/campaigns/ containing a crafted recipients array. The plugin's filter_recipients() validation routine is bypassed because an integer cast of a string such as 1) OR ... evaluates to a valid numeric identifier, allowing the raw string to be stored intact.

The injection is later triggered when the attacker issues a GET request to /mrm/v1/campaigns/{id}. The stored recipients data is deserialized and the unsanitized id string flows through array_column() into a SQL query in ContactGroupPivotModel. Because the query is concatenated without proper preparation, the appended SQL executes against the WordPress database.

Root Cause

The root cause is dual: input validation in filter_recipients() relies on PHP integer casting, which silently accepts numeric-prefixed strings, and the downstream query in ContactGroupPivotModel does not use $wpdb->prepare() for the recipient identifiers. This combination allows attacker-controlled fragments to reach the database layer verbatim.

Attack Vector

Exploitation requires an authenticated account with administrator privileges or higher. The attacker submits a campaign creation request with a recipients entry whose id field contains a SQL fragment prefixed by a digit. Retrieving the campaign afterward triggers execution. Refer to the Wordfence Vulnerability Report and the Mail Mint CampaignController source for detailed technical context.

The vulnerability mechanism is described in prose above. No verified
exploitation code is published; see the linked source references for
the vulnerable code paths in CampaignController.php and
ContactGroupPivotModel.php.

Detection Methods for CVE-2026-12918

Indicators of Compromise

POST requests to /mrm/v1/campaigns/ containing recipients entries with id values that mix digits and SQL keywords such as OR, UNION, SELECT, or closing parentheses.
GET requests to /mrm/v1/campaigns/{id} immediately followed by anomalous database read patterns or increased query latency.
Unexpected campaign records containing malformed serialized recipient arrays in the wp_mint_campaigns table.

Detection Strategies

Inspect the Mail Mint plugin version. Any installation at or below 1.24.1 is vulnerable and should be treated as at-risk.
Review WordPress access logs for administrator-authenticated requests to the mrm/v1/campaigns REST endpoints originating from unusual IPs or user agents.
Enable MySQL general query logging temporarily and search for queries referencing recipient id lists that contain SQL metacharacters.

Monitoring Recommendations

Monitor WordPress wp-json/mrm/v1/campaigns traffic through a web application firewall with SQL injection signatures enabled.
Alert on administrator account activity outside of normal business hours, particularly campaign creation followed by rapid retrieval.
Track database error rates and slow query counts on hosts running Mail Mint to catch injection attempts that produce syntax errors.

How to Mitigate CVE-2026-12918

Immediate Actions Required

Update the Mail Mint plugin to a version newer than 1.24.1 as soon as a patched release is available from the vendor.
Audit all WordPress administrator accounts and remove any that are unused, dormant, or unnecessarily privileged.
Enforce strong authentication and multi-factor authentication for every administrator account to reduce the risk of the required privileged access being obtained.

Patch Information

The vendor released a fix documented in the Mail Mint changeset 3592458. Site administrators should apply the update through the WordPress plugin manager and verify the installed version is above 1.24.1 after the upgrade.

Workarounds

Deactivate the Mail Mint plugin until a patched version is installed if immediate updating is not possible.
Restrict access to the /wp-json/mrm/v1/campaigns endpoint at the web server or WAF layer to trusted management IP addresses.
Review recent campaign records for suspicious recipient payloads and delete any that contain non-numeric characters in id fields.

bash

# Example: block access to Mail Mint REST endpoints from untrusted networks (nginx)
location ~* /wp-json/mrm/v1/campaigns {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
}