What the vulnerability does
01Description
The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce validation on the create_or_update_note function. This makes it possible for unauthenticated attackers to create or update contact notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to missing sanitization and escaping this can lead to stored Cross-Site Scripting.
Explanation of Vulnerability in Simple Terms
02Summary
Mail Mint contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 1.19.2. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the Mail Mint plugin without the admin's knowledge or consent. This could allow unauthorized changes to email marketing settings or configurations.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions in Mail Mint on behalf of a logged-in administrator who visits a malicious webpage.
Potential impact on your site
04Site Impact
An attacker could modify email marketing campaigns, automation rules, or plugin settings if an admin visits a malicious link.
Conditions required to exploit
05Prerequisites
Administrator must be logged into WordPress and visit an attacker-controlled webpage while the session is active.
Key dates
06Disclosure timeline
February 3, 2026
CVE published
April 8, 2026
Record updated
