PHP Object Injection Vulnerability in The Mail Mint WordPress Plugin

The Mail Mint plugin for WordPress, a tool for email marketing and automation, contains a critical PHP Object Injection vulnerability (CVE-2026-10196) affecting all versions up to and including 1.31.0. The vulnerability resides in the handle_form_submission function, which performs unsafe deserialization of untrusted user input.

By injecting a malicious serialized PHP object, an unauthenticated remote attacker can leverage existing POP (Property Oriented Programming) chains within the application's codebase to achieve remote code execution. Although a partial fix was introduced in version 1.23.1, the vulnerability remained exploitable in subsequent releases up to 1.31.0. This flaw poses a high risk, as it allows attackers to gain unauthorized control over the underlying web server, potentially leading to full site compromise, exfiltration of sensitive email marketing data, and persistence.

Impact

Successful exploitation allows for unauthenticated remote code execution on the web server hosting the WordPress instance. This could result in total compromise of the affected WordPress site, unauthorized access to subscriber email lists, and potential lateral movement within the hosting environment.

Recommendation

• Immediately update The Mail Mint WordPress plugin to the latest available version (beyond 1.31.0) to remediate CVE-2026-10196.
• Audit web server logs for suspicious HTTP POST requests directed at endpoints responsible for form submissions if the site was running vulnerable versions.
• Monitor for unexpected child processes spawned by the web server process (e.g., www-data or nginx) originating from the WordPress installation directory.