Description

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-05T12:16:46.790Z",
  "pubdate": "2026-09-05T12:16:46.790Z",
  "executiveSummary": "The Mail Mint plugin for WordPress is susceptible to a critical PHP Object Injection vulnerability impacting all versions up to and including 1.31.0.\nThe flaw originates from the insecure deserialization of untrusted user input within the 'handle_form_submission' function.\nThis vulnerability allows unauthenticated remote attackers to inject malicious PHP objects into the application environment.\nThe presence of a POP (Property Oriented Programming) chain within the codebase enables attackers to escalate this injection into Remote Code Execution (RCE), leading to full server compromise.\nGiven that the exploit requires no authentication and targets a publicly accessible function, the risk is classified as critical.\nAttackers can leverage this mechanism to execute arbitrary system commands, bypass security controls, and manipulate the underlying WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-supplied data in the 'handle_form_submission' function, which processes input via PHP's deserialization mechanism (typically unserialize()) without adequate validation or sanitization.\nPHP Object Injection occurs when an attacker supplies a crafted serialized string to the vulnerable function. When processed, the application instantiates an object of a class that exists within the plugin or the broader WordPress ecosystem.\nBy controlling the serialized properties of the injected object, an attacker can manipulate the internal state of existing classes. If these classes contain 'magic methods'—such as __destruct(), __wakeup(), or __toString()—the attacker can trigger unexpected code execution flows.\nAn attacker can construct a POP chain by chaining together various magic methods present in the application's loaded classes. This chain allows the attacker to reach a 'sink' where sensitive operations occur, such as file deletion, arbitrary function calls, or file system interaction, ultimately resulting in Remote Code Execution (RCE).\nThe attack flow proceeds as follows: First, the attacker identifies the entry point in the 'handle_form_submission' function. Second, the attacker crafts a malicious serialized payload containing a serialized object structure designed to trigger a specific POP chain. Third, the attacker sends this payload to the vulnerable endpoint via an HTTP request. Finally, upon deserialization, the PHP engine invokes the magic methods defined in the object, executing the intended malicious logic on the server.\nThis vulnerability is particularly severe because it is reachable by unauthenticated users, meaning no administrative or subscriber-level access is required to initiate the attack. The exploit operates over the network, exposing the host server to unauthorized remote control and data exfiltration. Although a partial patch was introduced in version 1.23.1, the persistence of the vulnerability through version 1.31.0 indicates that the original remediation was insufficient to fully neutralize the deserialization risk."
}