CVE-2026-1258

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1258", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T20:05:01.189Z", "datePublished": "2026-02-14T08:26:48.193Z", "dateUpdated": "2026-04-08T17:28:32.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:32.434Z"}, "affected": [{"vendor": "getwpfunnels", "product": "Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.19.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries."}], "title": "Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb59bca-0653-4e75-8da1-e78e5d659422?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Database/models/FormModel.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Internal/Automation/Core/DataStore/AutomationStore.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/API/Actions/Admin/Email/TemplateAction.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Utilities/Helper/Import.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Paolo Tresso"}], "timeline": [{"time": "2026-01-09T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-20T20:20:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T19:51:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:36:23.534985Z", "id": "CVE-2026-1258", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:44:11.270Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:23.534985Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:24.196Z"}}], "cna": {"title": "Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints", "credits": [{"lang": "en", "type": "finder", "value": "Paolo Tresso"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "getwpfunnels", "product": "Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.19.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-09T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-20T20:20:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T19:51:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb59bca-0653-4e75-8da1-e78e5d659422?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Database/models/FormModel.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Internal/Automation/Core/DataStore/AutomationStore.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/API/Actions/Admin/Email/TemplateAction.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Utilities/Helper/Import.php"}], "descriptions": [{"lang": "en", "value": "The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:32.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1258", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:32.434Z", "dateReserved": "2026-01-20T20:05:01.189Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T08:26:48.193Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails", "vendor": "getwpfunnels", "versions": [{"lessThanOrEqual": "1.19.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries."}, {"lang": "es", "value": "El plugin Mail Mint para WordPress es vulnerable a inyecci\u00f3n SQL ciega a trav\u00e9s de los endpoints de la API 'forms', 'automation', 'email/templates' y 'contacts/import/tutorlms/map' en todas las versiones hasta la 1.19.2, inclusive. Esto se debe a un escape insuficiente en los par\u00e1metros 'order-by', 'order-type' y 'selectedCourses' suministrados por el usuario y a la falta de preparaci\u00f3n suficiente en las consultas SQL existentes. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes."}], "id": "CVE-2026-1258", "lastModified": "2026-06-17T10:15:24.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1258", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:36:23.534985Z", "version": "2.0.3"}}]}, "published": "2026-02-14T09:16:12.190", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/API/Actions/Admin/Email/TemplateAction.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Database/models/FormModel.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Internal/Automation/Core/DataStore/AutomationStore.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Utilities/Helper/Import.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb59bca-0653-4e75-8da1-e78e5d659422?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2]"}}], "product": "mail_mint_\u2013_newsletters,_email_marketing,_automation,_woocommerce_emails,_post_notification,_and_more", "vendor": "getwpfunnels"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:36:03.449669+00:00", "value": {"mitigation_remediation": ["Apply the latest patch for Mail\u202fMint that replaces vulnerable queries with parameterized statements and correctly sanitizes user input.", "Implement strict input validation on the 'order-by', 'order-type', and 'selectedCourses' parameters to allow only expected values.", "Limit administrator-level access to the WordPress admin and API endpoints to trusted users, using role\u2011based access controls.", "Configure a web application firewall or server rule set to block requests containing SQL injection patterns targeting the affected endpoints."], "summary": {"action": "Patch", "impact": "Unauthorized database access via blind SQL injection"}, "threat_synthesis": {"affected_systems": "All releases of the Mail\u202fMint WordPress plugin up to and including version\u202f1.19.2 are affected. The plugin, maintained by getwpfunnels, is used for email marketing, newsletters, and automation within the WordPress ecosystem. Only the API endpoints listed in the description \u2013 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' \u2013 are vulnerable; the rest of the plugin remains unchanged.", "description_and_impact": "The Mail\u202fMint plugin for WordPress includes multiple API endpoints that fail to properly escape user\u2011supplied parameters such as 'order-by', 'order-type', and 'selectedCourses'. This omission allows an authenticated user with administrator or higher privileges to inject and execute arbitrary SQL statements in a blind context, enabling attackers to read or modify database content, potentially exposing sensitive subscriber data or tampering with campaign configurations. The vulnerability does not grant code execution but compromises data integrity and confidentiality with significant operational impact.", "risk_and_exploitability": "The CVSS v3.1 score is 4.9, reflecting moderate severity, and the EPSS probability is reported as less than 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires administrator\u2011level credentials, the primary vector is remote or local access via the WordPress admin interface or the exposed API. An attacker who can authenticate as an admin can send crafted requests that append malicious SQL to existing queries, potentially extracting or corrupting database data. While the exploitation probability is low, any environment that assigns broad admin privileges to users presents a risk that should be mitigated promptly."}}}}, "created": "2026-02-16T12:01:53.870700+00:00", "updated": "2026-04-15T20:45:06.381092+00:00", "vendors": ["getwpfunnels", "getwpfunnels$PRODUCT$mail_mint_\u2013_newsletters,_email_marketing,_automation,_woocommerce_emails,_post_notification,_and_more", "wordpress", "wordpress$PRODUCT$wordpress"]}