The Mail Mint plugin for WordPress includes multiple API endpoints that fail to properly escape user‑supplied parameters such as 'order-by', 'order-type', and 'selectedCourses'. This omission allows an authenticated user with administrator or higher privileges to inject and execute arbitrary SQL statements in a blind context, enabling attackers to read or modify database content, potentially exposing sensitive subscriber data or tampering with campaign configurations. The vulnerability does not grant code execution but compromises data integrity and confidentiality with significant operational impact.

All releases of the Mail Mint WordPress plugin up to and including version 1.19.2 are affected. The plugin, maintained by getwpfunnels, is used for email marketing, newsletters, and automation within the WordPress ecosystem. Only the API endpoints listed in the description – 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' – are vulnerable; the rest of the plugin remains unchanged.

The CVSS v3.1 score is 4.9, reflecting moderate severity, and the EPSS probability is reported as less than 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires administrator‑level credentials, the primary vector is remote or local access via the WordPress admin interface or the exposed API. An attacker who can authenticate as an admin can send crafted requests that append malicious SQL to existing queries, potentially extracting or corrupting database data. While the exploitation probability is low, any environment that assigns broad admin privileges to users presents a risk that should be mitigated promptly.