Description

Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:25.917Z",
  "pubdate": "2026-09-03T17:17:25.917Z",
  "executiveSummary": "Mail Mint versions 1.31.0 and earlier are susceptible to an unauthenticated broken access control vulnerability. This security flaw allows unauthenticated remote attackers to perform unauthorized actions by manipulating requests targeting the plugin's endpoints. Because the plugin fails to enforce proper authentication and authorization checks, unauthorized actors can potentially bypass security mechanisms intended to restrict access to administrative or sensitive functionalities. The impact is significant, as it could lead to unauthorized data manipulation or administrative control over affected systems. Exploitation does not require prior authentication, making it accessible to any network-capable attacker. Organizations using vulnerable versions are at risk of compromise if the plugin is exposed to public-facing network segments. We recommend immediate assessment of the plugin's configuration and adherence to the principle of least privilege while awaiting vendor-supplied patches.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust access control mechanisms within the Mail Mint plugin's request handling logic. Specifically, the affected endpoints within the plugin fail to validate the session state or the authentication status of the incoming request before executing backend functions. In many WordPress plugins, administrative or internal functions are mapped to specific hooks or controllers that should verify the current user's capabilities via functions like current_user_can() or check_admin_referer(). In Mail Mint version 1.31.0 and below, these essential security checks are either omitted or improperly implemented for certain API calls or form handlers.\nThe attack flow commences when an unauthenticated actor identifies a target endpoint within the Mail Mint plugin. By crafting a specific HTTP request, such as a GET or POST request targeting the vulnerable component, the attacker circumvents the plugin's intended security architecture. Because the plugin does not verify the identity of the requester, the application logic proceeds to process the request as if it were legitimate. This allows the attacker to trigger internal functions, modify application data, or potentially perform unauthorized administrative operations that are inherently restricted to authenticated users with high-level privileges.\nThe root cause is a fundamental flaw in the access control design where sensitive business logic is exposed to the public web context. The vulnerability is present across all versions up to and including 1.31.0. The lack of proper nonce verification or capability checks means that an attacker does not require any existing account on the WordPress site. The network exposure is broad, as the vulnerability resides at the web-application layer; any device with network access to the target WordPress instance can initiate the exploit. Post-exploitation, an attacker could potentially disrupt service, exfiltrate sensitive marketing data, or manipulate email campaign configurations stored within the plugin. The absence of sufficient authorization protocols at the entry point of these functions permits direct access to backend logic that should be protected by the underlying CMS authentication framework."
}