CVE-2026-19800 Overview
The Mail Mint plugin for WordPress contains a SQL injection vulnerability in the contact filtering functionality. The flaw affects all versions up to and including 1.31.0 and stems from unsafe concatenation of the user-supplied status parameter into a SQL query before $wpdb->prepare() executes. Authenticated attackers holding the mint_read_contacts capability, which is only assignable by an administrator, can append additional SQL statements to extract data from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrator-level attackers can inject arbitrary SQL through the REST API status parameter, enabling extraction of sensitive database contents including user credentials and personal data.
Affected Products
- Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress
- All versions up to and including 1.31.0
- WordPress sites where the mint_read_contacts capability has been granted to non-administrator roles
Discovery Timeline
- 2026-09-09 - CVE-2026-19800 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-19800
Vulnerability Analysis
The vulnerability resides in the Mail Mint contact filtering logic exposed through the plugin's REST API. The ContactController builds a $contact_filter_query fragment from the attacker-controlled status array and concatenates that fragment directly into the SQL format string passed to $wpdb->prepare(). Because prepare() only substitutes %s and %d placeholders, any SQL syntax already embedded in the format string reaches the database engine intact. Attackers can use this behavior to append UNION SELECT statements or subqueries that read arbitrary rows from wp_users, wp_usermeta, and other sensitive tables.
Root Cause
Two compounding defects produce the sink. First, the plugin builds SQL by string concatenation rather than parameterization, so prepare() cannot neutralize injected syntax. Second, REST API JSON bodies are read from php://input and bypass WordPress's wp_magic_quotes() normalization. Double-quote characters inside status array values therefore reach the query builder unescaped, giving an attacker a reliable path to break out of the intended SQL context.
Attack Vector
Exploitation requires a valid authenticated session with the mint_read_contacts capability. This capability is plugin-specific and not assigned to any default WordPress role, so it must be explicitly granted by an administrator, effectively limiting exploitation to administrator-equivalent accounts. The attacker sends a crafted JSON body to the vulnerable contact-listing REST endpoint with a status array containing SQL metacharacters. The injected payload is appended to the existing query, and the database returns the attacker-requested data in the response.
See the vulnerable code paths in the Mail Mint ContactController, ContactRoute, and ContactModel sources.
Detection Methods for CVE-2026-19800
Indicators of Compromise
- REST API requests to Mail Mint contact endpoints containing SQL metacharacters (", ), UNION, SELECT, --) inside the JSON status array
- Unexpected UNION-based query patterns in MySQL slow query or general logs originating from the WordPress database user
- Anomalous response sizes from the /wp-json/mrm/v1/contacts route or similar Mail Mint contact-listing endpoints
- New or modified plugin capability assignments granting mint_read_contacts to non-administrator roles
Detection Strategies
- Inspect web server logs for POST or GET requests to Mail Mint REST routes containing encoded SQL syntax in request bodies read from php://input
- Enable MySQL query logging on WordPress database users and alert on information_schema reads or UNION SELECT patterns tied to plugin traffic
- Correlate authenticated administrator sessions with sudden volumes of contact API requests that deviate from baseline behavior
Monitoring Recommendations
- Monitor WordPress audit logs for administrator account creation, capability changes, and plugin configuration edits
- Track outbound data volume from the WordPress host for signs of database exfiltration following API calls
- Alert on any modification to Mail Mint plugin files outside of scheduled update windows
How to Mitigate CVE-2026-19800
Immediate Actions Required
- Update the Mail Mint plugin to a version later than 1.31.0 that contains the vendor fix referenced in the Mail Mint changeset
- Audit all WordPress roles for unexpected assignment of the mint_read_contacts capability and revoke it where not required
- Rotate WordPress administrator passwords and any secrets that may have been readable from the database if exploitation is suspected
Patch Information
The vendor addressed the issue in a release after 1.31.0. Review the fixed code in the Mail Mint 1.30.1 ContactController, 1.30.1 ContactRoute, and 1.30.1 ContactModel, along with the Wordfence vulnerability report for advisory details.
Workarounds
- Restrict access to the WordPress admin area and REST API endpoints via IP allowlisting on the web server or WAF
- Deploy WAF rules that block SQL metacharacters in JSON bodies sent to /wp-json/mrm/* routes
- Temporarily deactivate the Mail Mint plugin on sites that cannot immediately update
- Enforce least-privilege administration and require multi-factor authentication for all WordPress administrator accounts
# Example: apply plugin update via WP-CLI
wp plugin update mail-mint --version=latest
# Verify the installed version is above 1.31.0
wp plugin get mail-mint --field=version
# Audit which roles hold the vulnerable capability
wp role list --fields=role,name
wp cap list administrator | grep mint_read_contacts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
