{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mail-mint--1.31.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpfunnels:mail_mint:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-84753"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mail Mint (\u003c= 1.31.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","php","vulnerability","rce"],"_cs_type":"advisory","_cs_vendors":["WPFunnels"],"content_html":"\u003cp\u003eMail Mint versions 1.31.0 and lower contain a critical vulnerability (CVE-2026-84753) involving unauthenticated PHP object injection. The vulnerability exists within the REST API endpoint '/mint-form-submit', where user-supplied contact meta data is passed to the 'maybe_unserialize()' function without proper validation. Attackers can exploit this by submitting crafted serialized PHP objects via POST requests, potentially leading to remote code execution if compatible gadget chains are available in the target environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress instance with Mail Mint \u0026lt;= 1.31.0 enabled.\u003c/li\u003e\n\u003cli\u003eAttacker performs a GET request to '/?rest_route=/wp/v2/pages' to retrieve the page slug or nonce required for form submission.\u003c/li\u003e\n\u003cli\u003eAttacker sends an initial POST request to '/mint-mail/v1/mint-form-submit' containing malicious serialized data in the contact meta fields.\u003c/li\u003e\n\u003cli\u003eThe plugin's 'FormAction::handle_form_submission' function stores this data as contact meta verbatim.\u003c/li\u003e\n\u003cli\u003eAttacker sends a second POST request targeting the same contact context.\u003c/li\u003e\n\u003cli\u003eThe plugin retrieves the meta data via 'ContactModel::get'.\u003c/li\u003e\n\u003cli\u003eThe application invokes 'safe_unserialize_meta', which calls 'maybe_unserialize' on the stored malicious payload.\u003c/li\u003e\n\u003cli\u003ePHP instantiates the attacker-provided objects, triggering execution through magic methods (e.g., __wakeup or __destruct).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary PHP object instantiation. Depending on the available class definitions and gadget chains within the WordPress environment, this can result in remote code execution, unauthorized data modification, or service disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate the Mail Mint plugin to version 1.31.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eVerify the patch by inspecting the application code to ensure that 'is_serialized()' inputs are rejected and 'allowed_classes' is set to 'false' during unserialization operations.\u003c/li\u003e\n\u003cli\u003eScan application debug logs (e.g., 'debug.log') for unexpected PHP class name errors indicating failed injection attempts, such as the proof-of-concept witness 'POCWitness84753'.\u003c/li\u003e\n\u003cli\u003eDo not rely solely on WAF signatures; prioritization should be placed on patching the underlying software component.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-31T02:05:07Z","date_published":"2026-10-31T02:05:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mail-mint-rce/","summary":"Mail Mint versions 1.31.0 and earlier contain an unauthenticated PHP object injection vulnerability in the REST API endpoint /mint-form-submit that allows remote attackers to trigger arbitrary object instantiation.","title":"Mail Mint: Unauthenticated PHP Object Injection (CVE-2026-84753)","url":"https://feed.craftedsignal.io/briefs/2026-10-mail-mint-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Mail Mint (\u003c= 1.31.0)","version":"https://jsonfeed.org/version/1.1"}