External risk intelligence

WordPress Mail Mint Plugin PHP Object Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-10196

The vulnerability exists in a WordPress plugin designed for email marketing and form submissions. These features are intended to be public-facing by design to capture user input and interact with website visitors, making them directly reachable over the internet in standard WordPress deployments.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for email marketing and automation. This issue, stemming from improper handling of user input, could allow unauthorized access to execute code on servers, potentially impacting the integrity and availability of your online presence. The main concern is confirming relevance and exposure.

Unauthenticated attackers can execute code on servers.
Protects customer data and ensures service continuity.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the Mail Mint plugin on a WordPress website by submitting specially crafted data to a form. This data, when processed by the plugin's form submission handler, is deserialized in a way that can lead to PHP Object Injection. If a specific chain of PHP objects is available on the server, this injection can result in arbitrary code execution.

No authentication required.
Submit malicious form data.
Server-side code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to inject PHP objects into a WordPress site. When combined with a specific chain of PHP classes (POP chain), this injection could lead to arbitrary code execution on the server, provided the conditions for the POP chain are met.

Server code execution.
Unauthenticated remote injection.
Complete server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams should prioritize identifying all instances of the affected WordPress plugin. Given the vulnerability's potential for unauthenticated code execution, it is critical to confirm whether these instances are internet-facing and business-critical. Once identified and prioritized, coordinate with vendor-management or directly with the plugin vendor to plan for remediation, potentially through temporary risk reduction measures if an immediate fix is not feasible.

Identify affected WordPress instances.
Verify external reachability and business impact.
Plan remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mail Mint WordPress plugin?

Mail Mint is a plugin for WordPress designed to handle email marketing, newsletter distribution, and automation. It often integrates with WooCommerce to manage customer emails and site communication. Because it handles incoming data for form submissions, it requires specific server-side logic to process visitor interactions.

How does CVE-2026-10196 cause a security risk?

This vulnerability involves PHP Object Injection, categorized as CWE-502. It occurs when the plugin improperly handles untrusted data during deserialization. When this injected data interacts with certain existing code structures on the server—known as a POP chain—it can allow an attacker to execute unauthorized commands or code.

Do I need to be logged in to trigger this vulnerability?

No, authentication is not required to trigger the issue. An attacker can exploit the vulnerability by submitting specially crafted data to the plugin's form submission process. Simply viewing the site or interacting with standard, non-form elements does not trigger this specific flaw; it requires a targeted submission to the vulnerable handler.

How does Halo Surface Signal assess this CVE?

Halo Surface Signal rates this as highly relevant because Mail Mint is designed for public interaction. Since the plugin's primary purpose is collecting form data from website visitors, its components are naturally internet-facing. This exposure increases the likelihood that a remote attacker can reach the vulnerable code path.

What is the recommended first step for administrators?

Prioritize identifying every WordPress instance where the Mail Mint plugin is installed. Once you have a complete inventory, verify which of those sites are accessible over the internet and serve business-critical functions. After confirming your exposure, review the plugin vendor's updates to plan for the necessary version upgrade.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.