CVE-2026-27349: Mail Mint Information Disclosure Flaw

CVE-2026-27349 Overview

CVE-2026-27349 is a sensitive data exposure vulnerability in the WPFunnels Team Mail Mint plugin for WordPress. The flaw is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. Authenticated users with low privileges can retrieve embedded sensitive data that should remain restricted. The vulnerability affects all Mail Mint versions up to and including 1.19.5.

Critical Impact

Low-privileged authenticated users can extract embedded sensitive information from Mail Mint, exposing data that should remain within trusted boundaries.

Affected Products

• WPFunnels Team Mail Mint plugin for WordPress
• Mail Mint versions from n/a through 1.19.5
• WordPress sites running vulnerable Mail Mint installations

Discovery Timeline

• 2026-05-21 - CVE CVE-2026-27349 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-27349

Vulnerability Analysis

The vulnerability resides in the Mail Mint WordPress plugin developed by WPFunnels Team. Mail Mint is an email marketing and automation plugin used to manage subscribers, campaigns, and automation flows. The flaw allows an authenticated attacker with low privileges to access sensitive system information embedded within plugin responses or storage locations.

The issue is categorized under [CWE-497], which describes scenarios where an application stores sensitive information accessible to actors outside the intended trust boundary. The attack vector is network-based and requires no user interaction, lowering the barrier for exploitation by any authenticated user.

Root Cause

The root cause is improper restriction of access to embedded sensitive data within the Mail Mint plugin. The plugin exposes information through interfaces or endpoints that do not enforce sufficient authorization checks. Low-privileged users gain visibility into data intended only for administrators or internal plugin processes.

Attack Vector

An attacker requires an authenticated account on the target WordPress site with low privileges. The attacker sends crafted network requests to Mail Mint endpoints that return sensitive embedded data. No user interaction is required, and the attack does not impact integrity or availability. Only confidentiality of system information is affected.

For technical details on the disclosure, see the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-27349

Indicators of Compromise

• Unexpected requests to Mail Mint plugin endpoints from low-privileged user accounts
• Access patterns retrieving plugin configuration or embedded data fields
• Anomalous data exfiltration volume from WordPress sites running Mail Mint 1.19.5 or earlier

Detection Strategies

• Audit WordPress access logs for requests targeting Mail Mint REST API or AJAX endpoints originating from non-administrator accounts
• Review user session activity for subscribers or contributors accessing plugin functionality outside their normal role scope
• Correlate authentication events with subsequent data-retrieval requests to detect privilege misuse

Monitoring Recommendations

• Enable verbose logging on the WordPress site and forward logs to a centralized analysis platform
• Monitor for enumeration patterns against /wp-json/ endpoints associated with Mail Mint
• Alert on response payloads from Mail Mint endpoints that exceed expected size thresholds

How to Mitigate CVE-2026-27349

Immediate Actions Required

• Identify all WordPress installations running Mail Mint and confirm versions through the plugin management interface
• Update Mail Mint to a version released after 1.19.5 that addresses CVE-2026-27349
• Review user roles and remove unnecessary authenticated accounts that could exploit the flaw
• Audit recent access logs for signs of unauthorized data retrieval against Mail Mint endpoints

Patch Information

The vendor advisory is published through Patchstack. Refer to the Patchstack Vulnerability Advisory for the fixed version and patch details. Administrators should apply the patched release through the WordPress plugin updater as soon as it becomes available.

Workarounds

• Restrict Mail Mint plugin endpoints at the web application firewall (WAF) level to administrator IP ranges where feasible
• Disable the Mail Mint plugin temporarily on sites where a patched version cannot be applied immediately
• Enforce least-privilege principles by removing low-privileged accounts that do not require active site access

# Configuration example: list Mail Mint version via WP-CLI to inventory exposure
wp plugin get mail-mint --field=version

# Update Mail Mint to the latest patched release
wp plugin update mail-mint