CVE-2026-12918 getwpfunnels CVE debrief

Who should care

Users of the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress, particularly those with administrator-level access and above, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is a second-order SQL injection: the malicious payload is first stored unsanitized via a POST request to /mrm/v1/campaigns/ (bypassing filter_recipients() validation because an int-cast of a string like '1) OR ...' evaluates to a real numeric ID), and is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id} that deserializes the recipients and passes the raw id string through array_column() into the vulnerable query.

Defensive priority

Medium priority, as the vulnerability requires administrator-level access and above to exploit.

Recommended defensive actions

• Update the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin to a version that fixes the SQL injection vulnerability.
• Restrict access to the plugin's functionality to prevent unauthorized users from exploiting the vulnerability.
• Monitor the plugin's logs for suspicious activity that may indicate exploitation attempts.
• Perform a thorough review of the plugin's configuration and usage to identify potential exposure.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Conduct a thorough asset inventory to identify all systems that may be affected by this vulnerability.
• Establish a rollback plan in case the update cannot be applied immediately.

Evidence notes

The vulnerability was reported by [email protected] and is described in detail on the Wordfence website. The CVE record was published on 2026-07-10T10:16:22.893Z and has not been modified since then.

Official resources