Read the docs
TI-2026-75176 Aliases CVE-2026-111106GHSA-x22g-vhr9-fpv2

SQL injection in Mail Mint WordPress plugin via filters parameter

Priority LOW 29CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Mail Mint plugin for WordPress through version 1.31.4 contains an SQL injection flaw in the filters parameter of its segments contacts REST endpoint. Insufficient escaping of user-supplied filter values lets an authenticated user with the mint_read_contacts capability append additional SQL queries to existing ones, which can extract sensitive information from the database. The attack requires the mint_read_contacts capability, which Administrators have by default and which can be granted to lower roles.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getwpfunnelsMail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistanceup to 1.31.4—No fix listedCNA
  • Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance Vendorgetwpfunnels Affected up to 1.31.4 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Mail Mint (Email Marketing, Automation & WooCommerce Emails with AI Assistance).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111106
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Alias added: GHSA-x22g-vhr9-fpv2

References

Other 8

  • TI-2023-00167 WPFunnels < 2.6.9 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2026-12131 WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter CVSS 3.1CRITICAL 9.8
  • TI-2026-08934 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields CVSS 3.1CRITICAL 9.8
  • TI-2026-12715 WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter CVSS 3.1HIGH 8.8
  • TI-2025-14000 Missing authorization in getwpfunnels Creator LMS – Online Courses and eLearning Plugin CVSS 3.1HIGH 8.8
  • TI-2026-11129 WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter CVSS 3.1MEDIUM 6.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences