The Mail Mint plugin for WordPress contains a time‑based SQL injection flaw in the 'contact_ids' request parameter. The value of this parameter is concatenated directly into a database query without proper sanitisation or parameterisation, allowing an attacker who has authenticated with administrator or higher privileges to inject arbitrary SQL code. Successful exploitation can lead to the extraction of sensitive information from the site’s database, compromising confidentiality and potentially enabling further misuse of that data. The vulnerability is a classic input‑validation weakness classified under CWE‑89.

This vulnerability affects the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin from getwpfunnels, in all releases up to and including version 1.24.2. Any WordPress site that has this plugin installed and contains users with administrator or higher privileges is susceptible. Sites using versions newer than 1.24.2 are not impacted.

The CVSS score of 4.9 indicates a moderate severity, reflecting the requirement that the attacker must already possess administrator credentials and that the primary impact concerns data confidentiality. The EPSS score of < 1 % suggests that, at present, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires logging into WordPress with an administrator or higher account, sending a specially crafted request that injects a time‑based SQL condition into the contact_ids parameter, and using the delay response to confirm successful injection. Once exploited, the attacker can read arbitrary database tables and retrieve sensitive information.