/Vulnerability Library

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

CVE-2026-2025
Verified

Description

Mail Mint WordPress plugin < 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.

Severity

High

CVSS Score

7.5

Exploit Probability

2%

Affected Product

mail-mint

Published Date

March 16, 2026

Template Author

0x_akoko

CVE-2026-2025.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-2025
CWE ID:
cwe-200

References

https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/https://nvd.nist.gov/vuln/detail/CVE-2026-2025https://wordpress.org/plugins/mail-mint/

Remediation Steps

Update to version 1.19.5 or later.