CVE-2026-12918

🗓️ 10 Jul 2026 09:32:44Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

Authenticated administrators can exploit SQL injection in Mail Mint up to version 1.24.1 via recipients parameter.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-12918	10 Jul 202609:32	–	attackerkb
Circl	CVE-2026-12918	10 Jul 202612:05	–	circl
Cvelist	CVE-2026-12918 Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter	10 Jul 202609:32	–	cvelist
EUVD	EUVD-2026-42862	10 Jul 202609:32	–	euvd
NVD	CVE-2026-12918	10 Jul 202610:16	–	nvd
Patchstack	WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.24.1 - Authenticated (Administrator+) SQL Injection vulnerability	9 Jul 202620:55	–	patchstack
Positive Technologies	PT-2026-57139	10 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-12918: Improper Neutralization of Special Elements used in an SQL Command	10 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-12918 Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter	10 Jul 202609:32	–	vulnrichment

Vulners

Node

getwpfunnels mail_mintRange≤1.24.1wordpress

[
  {
    "vendor": "getwpfunnels",
    "product": "Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.24.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/mail-mint/tags/1.24.1/app/MrmCommon.php
plugins	www.plugins.trac.wordpress.org/browser/mail-mint/tags/1.24.1/app/API/Controllers/Admin/CampaignController.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bf7c500e-311f-4db5-8a54-de7b02fb11dd
plugins	www.plugins.trac.wordpress.org/browser/mail-mint/tags/1.24.1/app/Database/models/ContactGroupPivotModel.php
plugins	www.plugins.trac.wordpress.org/browser/mail-mint/tags/1.24.1/app/API/Controllers/Admin/CampaignController.php

Parameter	Position	Path	Description	CWE
recipients	request body	/mrm/v1/campaigns/	Second-order SQL injection via the recipients parameter; payload stored via POST to this endpoint and later triggered by GET to /mrm/v1/campaigns/{id} that deserializes recipients into a vulnerable query.	CWE-89
id	path	/mrm/v1/campaigns/{id}	Second-order SQL injection triggered by the id path parameter when used to construct a vulnerable query after prior storage via POST to /mrm/v1/campaigns/.	CWE-89

14 Jul 2026 02:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.14.9

EPSS0.00507

SSVC

CWE-89