Description
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
Published: 2026-09-03
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an unauthenticated PHP Object Injection in the Mail Mint plugin that allows an attacker to execute arbitrary code on the underlying server.

Affected Systems

WordPress sites that have the WPFunnels:Mail Mint plugin installed in versions 1.31.0 or earlier are affected. The vulnerability persists regardless of the WordPress core version or hosting environment.

Risk and Exploitability

The CVSS base score of 9.8 categorizes this flaw as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted request to the plugin’s endpoint without requiring authentication, enabling an attacker to inject objects and trigger code execution. The risk is therefore high, given the potential for full system compromise.

Generated by OpenCVE AI on September 3, 2026 at 20:41 UTC.

Remediation

Vendor Solution

Update the WordPress Mail Mint Plugin to the latest available version (at least 1.31.1).

OpenCVE Recommended Actions

  • Upgrade the Mail Mint plugin to version 1.31.1 or newer as provided by the vendor.
  • If an upgrade cannot be performed immediately, uninstall the plugin to eliminate the vulnerability until a patch is available.
  • Apply a web-application-firewall rule that blocks requests containing PHP object injection patterns targeting the Mail Mint plugin to reduce the attack surface.

Generated by OpenCVE AI on September 3, 2026 at 20:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Getwpfunnels
Getwpfunnels mail Mint
Wordpress
Wordpress wordpress
Vendors & Products Getwpfunnels
Getwpfunnels mail Mint
Wordpress
Wordpress wordpress

Sat, 05 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
Title WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Getwpfunnels Mail Mint
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-05T01:49:00.634Z

Reserved: 2026-09-02T09:57:31.409Z

Link: CVE-2026-84753

cve-icon Vulnrichment

Updated: 2026-09-05T01:48:56.070Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T17:17:25.673

Modified: 2026-09-05T02:17:18.017

Link: CVE-2026-84753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:28:40Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data