Mail Mint: Unauthenticated PHP Object Injection (CVE-2026-84753)

Mail Mint versions 1.31.0 and lower contain a critical vulnerability (CVE-2026-84753) involving unauthenticated PHP object injection. The vulnerability exists within the REST API endpoint '/mint-form-submit', where user-supplied contact meta data is passed to the 'maybe_unserialize()' function without proper validation. Attackers can exploit this by submitting crafted serialized PHP objects via POST requests, potentially leading to remote code execution if compatible gadget chains are available in the target environment.

Attack Chain

1. Attacker identifies a WordPress instance with Mail Mint <= 1.31.0 enabled.
2. Attacker performs a GET request to '/?rest_route=/wp/v2/pages' to retrieve the page slug or nonce required for form submission.
3. Attacker sends an initial POST request to '/mint-mail/v1/mint-form-submit' containing malicious serialized data in the contact meta fields.
4. The plugin's 'FormAction::handle_form_submission' function stores this data as contact meta verbatim.
5. Attacker sends a second POST request targeting the same contact context.
6. The plugin retrieves the meta data via 'ContactModel::get'.
7. The application invokes 'safe_unserialize_meta', which calls 'maybe_unserialize' on the stored malicious payload.
8. PHP instantiates the attacker-provided objects, triggering execution through magic methods (e.g., __wakeup or __destruct).

Impact

Successful exploitation allows for arbitrary PHP object instantiation. Depending on the available class definitions and gadget chains within the WordPress environment, this can result in remote code execution, unauthorized data modification, or service disruption.

Recommendation

1. Update the Mail Mint plugin to version 1.31.1 or later immediately.
2. Verify the patch by inspecting the application code to ensure that 'is_serialized()' inputs are rejected and 'allowed_classes' is set to 'false' during unserialization operations.
3. Scan application debug logs (e.g., 'debug.log') for unexpected PHP class name errors indicating failed injection attempts, such as the proof-of-concept witness 'POCWitness84753'.
4. Do not rely solely on WAF signatures; prioritization should be placed on patching the underlying software component.