CVE-2025-47541: Mail Mint Information Disclosure Flaw

CVE-2025-47541 Overview

CVE-2025-47541 is a sensitive information disclosure vulnerability in the WPFunnels Mail Mint plugin for WordPress. The flaw affects all versions of mail-mint up to and including 1.17.7. It is categorized under [CWE-201] Insertion of Sensitive Information Into Sent Data, meaning the application embeds confidential data in responses that should not contain it.

An unauthenticated remote attacker can retrieve embedded sensitive data over the network without user interaction. The issue affects confidentiality only, with no direct impact to integrity or availability.

Critical Impact

Unauthenticated attackers can retrieve sensitive data embedded in responses generated by Mail Mint versions through 1.17.7, exposing email marketing data managed by the plugin.

Affected Products

• WPFunnels Mail Mint plugin for WordPress
• Mail Mint versions from initial release through 1.17.7
• WordPress sites running the vulnerable mail-mint plugin

Discovery Timeline

• 2025-05-23 - CVE-2025-47541 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-47541

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive data within responses generated by the Mail Mint plugin. The plugin embeds confidential information into data sent to clients or external services that should not include it. This pattern aligns with [CWE-201], where applications inadvertently leak data through legitimate communication channels.

Mail Mint manages email marketing workflows, contact lists, and automation data for WordPress site owners. Sensitive content handled by the plugin may include subscriber details, campaign data, and internal identifiers. When this information is included in responses returned to unauthorized parties, it becomes accessible to remote actors.

The attack requires no authentication, no user interaction, and low complexity. According to the EPSS dataset, the probability of exploitation in the wild currently sits at 0.307% with a percentile of 53.99.

Root Cause

The root cause is improper output filtering inside Mail Mint endpoints or generated data flows. The plugin returns objects or payloads that include fields containing sensitive values, rather than restricting responses to non-sensitive attributes. This indicates missing data minimization controls in the response construction logic up to version 1.17.7.

Attack Vector

An attacker reaches the vulnerable functionality over the network by sending crafted requests to a WordPress site running the affected plugin. The response includes embedded sensitive data the attacker can parse and collect. No credentials, privileges, or user interaction are required, making automated mass scanning practical.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-47541

Indicators of Compromise

• Unauthenticated HTTP requests to Mail Mint REST endpoints under /wp-json/mailmint/ or /wp-admin/admin-ajax.php originating from unfamiliar IP addresses.
• Outbound responses from WordPress that contain subscriber email addresses, tokens, or internal identifiers in unauthenticated contexts.
• Repeated enumeration patterns targeting Mail Mint API routes within a short time window.

Detection Strategies

• Inventory WordPress installations and identify any running the mail-mint plugin at version 1.17.7 or earlier.
• Review web server access logs for unauthenticated requests to Mail Mint endpoints returning HTTP 200 responses with large payloads.
• Inspect responses from Mail Mint endpoints for fields containing personally identifiable information, API tokens, or subscriber data.

Monitoring Recommendations

• Enable WordPress audit logging and forward logs to a centralized analytics platform for anomaly review.
• Configure web application firewall rules to flag unauthenticated access patterns against mail-mint REST routes.
• Track plugin version drift across managed WordPress estates to ensure rapid identification of unpatched instances.

How to Mitigate CVE-2025-47541

Immediate Actions Required

• Update the Mail Mint plugin to a version released after 1.17.7 that addresses the sensitive data exposure issue.
• If immediate patching is not possible, deactivate the mail-mint plugin on affected WordPress sites until an update can be applied.
• Rotate API tokens, integration keys, and credentials handled by Mail Mint that may have been disclosed.

Patch Information

Review vendor guidance and the Patchstack Vulnerability Advisory for the fixed release. Apply the update through the WordPress plugin manager or via WP-CLI across all sites running mail-mint.

Workarounds

• Restrict access to Mail Mint endpoints using a web application firewall or .htaccess rules limiting traffic to known administrative IP addresses.
• Disable Mail Mint REST API routes that are not required for production workflows until the patched version is installed.
• Conduct a privacy impact review to determine whether disclosure notifications are required for affected subscribers.

# Configuration example: update Mail Mint via WP-CLI
wp plugin update mail-mint --version=latest
wp plugin list --name=mail-mint --fields=name,status,version