Improper neutralization of special elements in an SQL command allows attackers to inject malicious SQL through the Mail Mint plugin. This weakness is a classic SQL Injection (CWE‑89) that can enable an attacker to read, modify, or delete data stored in the on‑site database, compromising both confidentiality and integrity of site information. The vulnerability can also lead to broader compromise if sensitive administrative data is exposed or altered.

The issue affects the Mail Mint plugin from WPFunnels, impacting all versions up to and including 1.18.6. Users running any of these version numbers are susceptible; newer releases are presumed fixed.

The CVSS score of 7.6 classifies the flaw as high severity, while an EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been reported in widely publicized attacks. The likely attack vector is through normal web traffic where the plugin processes user or form input, meaning any visitor to a site with the vulnerable plugin could potentially trigger the injection if proper input validation is not enforced.