The vulnerability in the Mail Mint plugin allows an attacker to retrieve embedded sensitive data. This is a classic insertion of sensitive information into sent data flaw (CWE‑201). If an attacker can trigger the plugin’s email generation, the resulting email may contain confidential values, such as usernames, passwords, or other data that should not be exposed.

The flaw affects all installations of WPFunnels Mail Mint up to version 1.17.7. WordPress sites that have the plugin installed and use it to send emails are at risk. No specific PHP or WordPress major version is explicitly mentioned, so the vulnerability is considered universal for the plugin’s supported WordPress installations.

With a CVSS score of 7.5 the vulnerability is considered high. The EPSS score of less than 1% indicates that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Nevertheless, because the data exposed could be sensitive business or personal information, the potential impact remains significant. The attack vector is inferred to be remote. An attacker who can control email content or invoke the mailing functionality could exploit the flaw to read sensitive data without authentication.