CVE-2026-10196

The Mail Mint WordPress plugin (email marketing, newsletter, and automation) deserializes untrusted input in its 'handle_form_submission' function without adequate validation, enabling unauthenticated attackers to inject a PHP object. Because the form-submission handler requires no authentication or privileges, any visitor able to reach a Mail Mint form can trigger the flaw. By supplying a crafted serialized object, an attacker can exploit an available POP chain to execute code on the server, potentially leading to full site compromise (CVSS 9.8). All versions through 1.31.0 are affected; the fix in 1.23.1 was only partial, so sites running even partially patched releases remain exposed. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS assigns a 0.6% probability of exploitation within 30 days, indicating no confirmed in-the-wild exploitation yet.

What to do: Update Mail Mint to the first available release after 1.31.0, since 1.23.1 was only a partial fix and should not be relied upon. Until a fully patched release is applied, deactivate the plugin or restrict access to its form submission endpoints, and consider WAF rules blocking serialized-object (O:) patterns in form POSTs. No public PoC is known, but the flaw is unauthenticated and trivially triggerable wherever forms are exposed, so treat patching as high priority.