The Mail Mint WordPress plugin is vulnerable to SQL injection through the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to 1.31.4. The flaw arises because the user‑supplied filter value is interpolated directly into a numeric WHERE clause without proper quoting, and the surrounding $wpdb->prepare() does not encompass the injected portion. This allows an authenticated attacker who holds the custom mint_read_contacts capability to inject arbitrary SQL statements, read the database, and extract sensitive information.

The vulnerability affects the Mail Mint plugin (getwpfunnels:Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance) version 1.31.4 and earlier. Administrators receive the mint_read_contacts capability by default, and the plugin allows administrators to lower this capability to other roles via the plugin's role manager.

The CVSS score of 6.5 denotes moderate severity, while the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated REST API request; an attacker must first authenticate to WordPress and possess the mint_read_contacts capability. Because the payload is injected directly into the database query, a successful exploitation results in data disclosure of arbitrary tables. Given the moderate CVSS score and the low EPSS, the risk is considered significant for sites that have not patched or do not control the capability assignment.