CVE-2026-10196 getwpfunnels CVE debrief

Who should care

Defenders responsible for WordPress installations with the Mail Mint plugin should assess exposure and prioritize remediation. Security teams should verify plugin versions, evaluate the effectiveness of the partial patch, and implement compensating controls to mitigate potential code execution.

Why it matters

CVE-2026-10196 is a critical vulnerability in the Mail Mint plugin for WordPress, allowing unauthenticated PHP Object Injection and potential code execution. Defenders should prioritize verifying exposure, assessing the partial patch, and implementing compensating controls.

• Potential code execution on the server
• Unauthenticated PHP Object Injection
• Partial patch effectiveness verification required
• Compensating controls implementation necessary

Technical summary

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0. The vulnerability arises from deserialization of untrusted input in the 'handle_form_submission' function, allowing unauthenticated attackers to inject a PHP Object. The presence of a POP chain enables attackers to execute code on the server. A partial patch was applied in version 1.23.1.

Defensive priority

Defenders should prioritize verifying exposure of Mail Mint plugin versions up to 1.31.0, assessing the effectiveness of the partial patch in version 1.23.1, and implementing compensating controls to mitigate potential code execution.

Recommended defensive actions

• Verify Mail Mint plugin version and assess exposure
• Evaluate the effectiveness of the partial patch in version 1.23.1
• Implement compensating controls to mitigate potential code execution
• Monitor for potential exploitation attempts
• Review asset inventory for Mail Mint plugin deployments
• Plan for rollback or change windows if patching is delayed
• Track source references for updates on vulnerability exploitation

Evidence notes

The vulnerability was discovered in the Mail Mint plugin for WordPress, specifically in versions up to and including 1.31.0. The issue arises from the deserialization of untrusted input in the 'handle_form_submission' function, which allows for PHP Object Injection. A partial patch was applied in version 1.23.1, but full remediation details are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.