CVE-2026-1258

🗓️ 14 Feb 2026 08:26:48Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

CVE-2026-1258: Mail Mint plugin allows authenticated administrators to inject SQL via several API endpoints up to 1.19.2.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-1258	14 Feb 202608:26	–	attackerkb
CNNVD	WordPress plugin Mail Mint SQL注入漏洞	14 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-1258 Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints	14 Feb 202608:26	–	cvelist
NVD	CVE-2026-1258	14 Feb 202609:16	–	nvd
Patchstack	WordPress Mail Mint plugin <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints vulnerability	13 Feb 202623:49	–	patchstack
Positive Technologies	PT-2026-8099	14 Feb 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-1258: Improper Neutralization of Special Elements used in an SQL Command	14 Feb 202600:00	–	rapid7
RedhatCVE	CVE-2026-1258	15 Feb 202613:28	–	redhatcve
Vulnrichment	CVE-2026-1258 Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints	14 Feb 202608:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 9, 2026 to February 15, 2026)	19 Feb 202618:42	–	wordfence

Vulners

Node

getwpfunnels mail_mintRange≤1.19.2wordpress

[
  {
    "vendor": "getwpfunnels",
    "product": "Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.19.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Database/models/FormModel.php
plugins	www.plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Internal/Automation/Core/DataStore/AutomationStore.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/dfb59bca-0653-4e75-8da1-e78e5d659422
plugins	www.plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/Utilities/Helper/Import.php
plugins	www.plugins.trac.wordpress.org/changeset/3449536/mail-mint/trunk/app/API/Actions/Admin/Email/TemplateAction.php

Parameter	Position	Path	Description	CWE
order-by	query param	/forms	Blind SQL injection via unsafely escaped query parameters on /forms endpoint.	CWE-89
order-type	query param	/forms	Blind SQL injection via unsafely escaped query parameters on /forms endpoint.	CWE-89
selectedCourses	request body	/forms	Blind SQL injection via unsafely escaped request body parameter on /forms endpoint.	CWE-89
order-by	query param	/automation	Blind SQL injection via unsafely escaped query parameters on /automation endpoint.	CWE-89
order-type	query param	/automation	Blind SQL injection via unsafely escaped query parameters on /automation endpoint.	CWE-89
selectedCourses	request body	/automation	Blind SQL injection via unsafely escaped request body parameter on /automation endpoint.	CWE-89
order-by	query param	/email/templates	Blind SQL injection via unsafely escaped query parameters on /email/templates endpoint.	CWE-89
order-type	query param	/email/templates	Blind SQL injection via unsafely escaped query parameters on /email/templates endpoint.	CWE-89
selectedCourses	request body	/email/templates	Blind SQL injection via unsafely escaped request body parameter on /email/templates endpoint.	CWE-89
order-by	query param	/contacts/import/tutorlms/map	Blind SQL injection via unsafely escaped query parameters on /contacts/import/tutorlms/map endpoint.	CWE-89

17 Jun 2026 10:15Current

6Medium risk

Vulners AI Score6

CVSS 3.14.9

EPSS0.00372

SSVC

CWE-89