CVE-2026-2025

—

CVSS 3.1

7.5 high

EPSS

1%p70

Published

Mar 4, 2026 (Mar 4, 2026)

Modified

Jun 17, 2026

Description

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

Ecosystems: WordPress
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.