PT-2026-22868 · WordPress · Mail Mint

Published 2026-03-04 · Updated 2026-03-16 · CVE-2026-2025

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mail Mint WordPress plugin versions prior to 1.19.5

Description The Mail Mint WordPress plugin does not have proper authorization for one of its REST API endpoints. This allows unauthenticated users to access and retrieve the email addresses of users on the WordPress blog. The affected API endpoint allows unauthorized access to user data. The vulnerable parameter is not specified.

Recommendations Update the Mail Mint WordPress plugin to version 1.19.5 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-2025

Affected Products

Mail Mint

References · 10

• 🔥 https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2025 · Security Note
• https://twitter.com/pdnuclei_bot/status/2033468347845935469 · Twitter Post
• https://twitter.com/CVEarity/status/2029554370971672882 · Twitter Post
• https://twitter.com/CVEnew/status/2029086060504867168 · Twitter Post
• https://t.me/cveNotify/154077 · Telegram Post
• https://twitter.com/infoflowcloud/status/2029087128450175486 · Twitter Post
• https://t.me/CVEtracker/46277 · Telegram Post
• https://twitter.com/cyberbivash/status/2029112801109610560 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029180202467692808 · Twitter Post