CVE-2026-111106 getwpfunnels CVE debrief

Who should care

WordPress administrators and defenders responsible for securing WordPress installations with the Mail Mint plugin should assess their exposure to this vulnerability and prioritize verifying the presence of this vulnerability and assessing exposure of sensitive information.

Why it matters

The Mail Mint plugin for WordPress is vulnerable to SQL Injection, allowing authenticated attackers to potentially extract sensitive information from the database. Defenders should prioritize verifying the presence of this vulnerability and assessing exposure.

• Authenticated attackers with the custom 'mint_read_contacts' capability can potentially extract sensitive information from the database.
• Defenders need to verify the presence of this vulnerability in their WordPress installations.
• Remediation priority is high for WordPress installations with untrusted users or exposure to sensitive information.

Technical summary

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4. This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the exposure of sensitive information.

Recommended defensive actions

• Verify the presence of the Mail Mint plugin version 1.31.4 or earlier in your WordPress installation.
• Assess the exposure of sensitive information in your database.
• Consider upgrading to a patched version of the Mail Mint plugin.
• Restrict access to the 'mint_read_contacts' capability to trusted roles.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to insufficient escaping on the user-supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797. This issue allows attackers with the custom 'mint_read_contacts' capability to inject SQL queries, potentially leading to sensitive information disclosure. Defenders should verify the presence of the Mail Mint plugin version 1.31.4 or earlier and assess database exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.