Vulnerability · Published Mar 4, 2026 · Assigned by WPScan
CVE-2026-2025Mail Mint < 1.19.5 - Unauthenticated Emails Disclosure
High 7.5
In plain English
A high-severity information exposure in Mail Mint from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/ exploit, vdb-entry, technical-description