The vulnerability is a second‑order SQL injection that allows an administrator to submit a malicious payload in the 'recipients' field when creating or editing a campaign. The payload is stored unserialized and later inserted directly into an SQL query during a campaign retrieval, enabling the attacker to append arbitrary SQL statements. This can lead to unauthorized disclosure or manipulation of database contents, and the weakness is identified as CWE‑89.

The issue affects the Mail Mint Email Marketing plugin for WordPress, developed by GetWPFunnels. All releases up to and including version 1.24.1 are vulnerable. Sites running any supported WordPress installation with this plugin and possessing administrator‑level access to the campaign management interface are affected.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1% shows that the exploit is currently uncommon. The vulnerability is not listed in CISA's KEV catalogue. Because it requires authenticated administrator privileges and relies on a second‑order injection chain, the attack surface is limited to sites with such accounts. Detection may be difficult until an exploit is observed, and the primary risk is exposure of data that can be extracted or altered through the injected SQL.