The vulnerability arises from missing authorization checks in the WPFunnels Mail Mint plugin, allowing unauthenticated users to access privileged functionality. Because the plugin does not enforce ACLs, attackers can invoke plugin endpoints that should be restricted, potentially exposing sensitive data or performing unauthorized operations. This weakness is classified as CWE‑862.

The flaw affects WPFunnels Mail Mint for WordPress, versions from the initial release through 1.19.4. Any site running any version up to and including 1.19.4 is susceptible until an update is applied.

The EPSS score is below 1%, indicating a low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is likely via a direct HTTP request to the plugin’s exposed endpoints, requiring only that the plugin is active and the target site is publicly reachable. Because no additional authentication is enforced, any visitor can exploit it, making it simple to attack if the plugin is present.