Cyber & AI intelligence
Wasteland.
Briefs indexed2438
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-10196 2026-09-05

CVE-2026-10196: Unauthenticated PHP Object Injection in WordPress Mail Mint Plugin

"A critical (CVSS 9.8) deserialization flaw in the Mail Mint WordPress plugin lets unauthenticated attackers inject PHP objects and, if a usable POP chain is reachable, potentially execute code on the server."

A critical (CVSS 9.8) deserialization flaw in the Mail Mint WordPress plugin lets unauthenticated attackers inject PHP objects and, if a usable POP chain is reachable, potentially execute code on the server.

What Is It

CVE-2026-10196 is a PHP Object Injection vulnerability (CWE-502) in the Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress. The plugin deserializes untrusted input inside the handle_form_submission function, allowing an attacker to supply a crafted serialized payload that instantiates arbitrary PHP objects. A POP (property-oriented programming) chain is also reported to be present in the codebase, which would raise that object injection to remote code execution on the underlying server; though whether the chain is reachable in a given deployment depends on the installed plugin and dependency versions.

The vulnerability was reported by Wordfence and carries CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8, CRITICAL.

Why It Matters

Every barrier that normally slows an attacker is absent here. The attack is network-reachable, requires no privileges, needs no user interaction, and is low complexity. Impact is rated high across confidentiality, integrity, and availability, consistent with full compromise of the affected WordPress site and the code execution context it runs in.

The injection point is a frontend form submission handler, so the vulnerable path is exposed on public-facing pages by design. There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time, but an unauthenticated deserialization flaw with a claimed path to code execution, in a widely deployed WordPress marketing plugin, is exactly the profile that attracts mass scanning quickly.

What's Vulnerable

Patch Status

Per the NVD record, the vulnerability was partially patched in version 1.23.1: but versions through 1.31.0 remain listed as affected, meaning the partial patch did not fully close the issue. No fully fixed version is identified in the supplied source material.

Operators running Mail Mint should treat any installed version at or below 1.31.0 as vulnerable, monitor the vendor and Wordfence advisory for a complete fix, and consider disabling the plugin until one is confirmed. No CISA KEV required-action or due date applies, as this CVE is not in the supplied KEV data.

Sources