Exploitation Research Plan - CVE-2026-27349

1. Vulnerability Summary

The Mail Mint plugin (up to 1.19.5) contains an authentication bypass/improper authorization vulnerability in its REST API implementation. The plugin defines multiple administrative REST API endpoints under the mrm/v1 namespace. However, the base controllers and the specific route registrations fail to implement proper capability checks.

Specifically:

• Mint\MRM\Admin\API\Controllers\AdminBaseController::rest_permissions_check() returns true unconditionally.
• Mint\MRM\Admin\API\Controllers\SettingBaseController::rest_permissions_check() returns true unconditionally.
• Mint\MRM\Admin\API\Routes\FieldGroupRoute explicitly sets 'permission_callback' => '__return_true' for READABLE, CREATABLE, and EDITABLE methods.

This allows any authenticated user, such as a Subscriber, to access, read, and potentially modify administrative data like field groups, campaigns, and plugin settings.

2. Attack Vector Analysis

• Endpoint Namespace: mrm/v1
• Vulnerable Routes:
  • /wp-json/mrm/v1/field-groups/ (Confirmed via FieldGroupRoute.php)
  • /wp-json/mrm/v1/campaigns/ (Inferred from Server.php and AdminBaseController)
  • /wp-json/mrm/v1/settings/ (Inferred from Server.php and SettingBaseController)
• HTTP Method: GET (for Information Exposure)
• Authentication: Required (Subscriber level or higher)
• Preconditions: A valid wp_rest nonce must be provided in the X-WP-Nonce header for authenticated REST requests.

3. Code Flow

1. Route Registration: Mint\MRM\Admin\API\Server::rest_api_init() iterates through routes defined in get_routes().
2. Permission Setup: In FieldGroupRoute::register_routes(), the permission_callback is set to __return_true.
3. Request Dispatch: When a Subscriber sends a GET request to /wp-json/mrm/v1/field-groups/, WordPress calls the permission_callback.
4. Bypass: Since the callback returns true, the request proceeds to FieldGroupController::get_all().
5. Data Retrieval: FieldGroupController::get_all() calls MRM\Models\FieldGroup::get_all() (aliased from ModelsFieldGroup), which queries the database for all custom field groups and returns them to the unauthorized user.

4. Nonce Acquisition Strategy

To interact with the WordPress REST API as an authenticated user, a wp_rest nonce is required.

1. Login: Use the browser_login tool to authenticate as a Subscriber.
2. Navigate: Navigate to the WordPress dashboard (/wp-admin/).
3. Extraction: Use browser_eval to extract the REST nonce from the default WordPress wpApiSettings object.
   • JavaScript: window.wpApiSettings.nonce
4. Action: Use this nonce in the X-WP-Nonce header for all subsequent http_request calls.

5. Exploitation Strategy

The goal is to demonstrate that a Subscriber can access sensitive "Field Group" data created by an administrator.

Step 1: Unauthorized Information Retrieval

• Tool: http_request
• Method: GET
• URL: /wp-json/mrm/v1/field-groups/
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
  • Content-Type: application/json
• Expected Response: A 200 OK status with a JSON array containing the "Secret Field Group" details created during setup.

Step 2: Unauthorized Settings Retrieval (Secondary)

• Method: GET
• URL: /wp-json/mrm/v1/settings/
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Expected Response: Configuration data for the Mail Mint plugin.

6. Test Data Setup

Before exploitation, administrative data must exist to be exposed:

1. Create Subscriber: Use WP-CLI to create a user with the subscriber role.
2. Create Sensitive Data: Use WP-CLI (or browser_eval as admin) to create a dummy field group.

   # Example using wp eval to simulate admin creating a group
   wp eval "use MRM\Models\FieldGroup; use MRM\Data\FieldGroup as DataFieldGroup; \$fg = new DataFieldGroup(['title' => 'Internal Sales Leads', 'description' => 'Confidential lead data']); MRM\Models\FieldGroup::insert(\$fg);"
   

3. Verify Setup: Confirm the data exists in the database.

7. Expected Results

• Success Criteria: The Subscriber receives a JSON response containing the string "Internal Sales Leads".
• Status Code: 200 OK (If restricted, it would return 401 Unauthorized or 403 Forbidden).
• Data Content: The response should reveal id, title, and description of field groups that should only be visible to administrators.

8. Verification Steps

1. Check Response: Inspect the JSON returned by the http_request tool for the "Internal Sales Leads" field group.
2. Database Comparison: Run wp db query "SELECT * FROM wp_mrm_field_groups;" (table name inferred from plugin prefix) and compare the results with the REST API output.

9. Alternative Approaches

If the field-groups endpoint is blocked for some reason, attempt to access the campaigns endpoint:

• URL: /wp-json/mrm/v1/campaigns/
• Logic: Inherits from AdminBaseController which defines rest_permissions_check() { return true; }. This should leak campaign titles and sender emails.

Another high-impact target is the contact-import list:

• URL: /wp-json/mrm/v1/contact-import/ (GET)
• Check: Look for any methods in ContactImportAction.php that return MailChimp configuration or list data.