Security Alert Summary
The Mail Mint WordPress plugin contains a vulnerability in one of its REST API endpoints that lacks proper authorization. As a result, unauthenticated users can call the endpoint and retrieve the email addresses of users on the site. Site owners should verify whether they use the affected plugin versions and take appropriate mitigation steps.
CVE Details
- CVE ID: CVE-2026-2025
- Affected plugin / component: Mail Mint WordPress plugin
- Affected versions: Versions before 1.19.5 (as stated in the CVE description)
- Published: March 4, 2026 at 6:16:11 AM
- Last modified: March 4, 2026 at 6:16:11 AM
- CVSS v3.1 base score / severity / vector: Not specified in the CVE entry
- Authentication requirements: None — the endpoint can be accessed by unauthenticated users (per the description)
- Privileges required: None
- User interaction: None required
- Primary impact: Confidentiality — disclosure of user email addresses. Integrity: not indicated. Availability: not indicated.
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
According to the CVE description, one of Mail Mint’s REST API endpoints does not implement proper authorization checks. Because the endpoint allows unauthenticated requests, an attacker can call it and receive a list of user email addresses from the site. The root cause described is a missing authorization check on that REST API endpoint; no specific function names or endpoint paths are provided in the CVE entry.
The impact is limited to information disclosure of user email addresses as stated. The entry does not describe any additional injection, privilege escalation, or availability issues.
How This Could Impact Your Website
In a typical small or medium business WordPress site, the site owner and internal staff (editors, authors, contributors) share user accounts and contact information. If an unauthenticated attacker can retrieve email addresses exposed by this endpoint, those addresses could be used to target staff and contractors with phishing or social engineering campaigns. For example, an attacker could craft emails that appear legitimate to specific editors or external contributors and attempt to harvest credentials or request sensitive actions.
This vulnerability does not, by itself, indicate account takeover or direct modification of site content, but disclosure of contact information increases the risk of successful targeted attacks. professional review may be worthwhile if you’re unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry identifies versions before 1.19.5 as affected.)
- Review and reduce unnecessary user roles and accounts, especially contributor-level and other non-administrative accounts that are not actively used.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior, such as automated calls to REST API endpoints or bulk data access patterns.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
