BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-14342Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

4.9 MEDIUMEPSS 0.44%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
4.9MEDIUM3.1Wordfence (CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CVE ID
CVE-2026-14342
Status
Deferred
Assigner (CNA)
Wordfence
Published
Jul 9, 2026
Last modified
2026-07-09 16:19 UTC
Weaknesses
  • CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:23 UTC.