CVE-2026-2025: 
WordPress vulnerability analysis and mitigation

CVE-2026-2025 is an unauthenticated email address disclosure vulnerability in the Mail Mint WordPress plugin. The plugin fails to enforce authorization on one of its REST API endpoints, allowing any unauthenticated user to retrieve the email addresses of all registered users on the affected WordPress site. It affects Mail Mint versions prior to 1.19.5 and was publicly disclosed on February 11, 2026, with CVE assignment recorded on March 4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (WPScan, Feedly).

The root cause is a missing authorization check (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) on the /wp-json/mrm/v1/wp/admins REST API endpoint exposed by the Mail Mint plugin. An unauthenticated attacker can send a simple HTTP GET request with a search term (e.g., ?term=@ or ?term=gmail) to enumerate and retrieve email addresses of WordPress users, including administrators. No authentication, session token, or special privileges are required, and exploitation requires only network access to the target WordPress installation (WPScan).

Successful exploitation results in the disclosure of registered user email addresses — including administrator accounts — to any unauthenticated attacker. This constitutes a high confidentiality impact with no integrity or availability impact. Exposed email addresses can be leveraged for targeted phishing campaigns, credential stuffing attacks, or spam, and may facilitate further compromise of the WordPress site or its users (WPScan, Feedly).

A public proof-of-concept (PoC) is available via WPScan, consisting of simple curl commands requiring no special tooling or authentication. The EPSS score is approximately 0.008% (very low automated exploitation probability at time of publication), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nuclei templates for automated detection have been added to the ProjectDiscovery nuclei-templates repository, indicating active tooling interest from the security community (WPScan, Nuclei Templates).

1. Reconnaissance: Identify WordPress sites running the Mail Mint plugin (versions < 1.19.5) using tools like WPScan, Shodan, or by checking /wp-content/plugins/mail-mint/ for plugin presence.
2. Confirm endpoint availability: Send a test request to verify the vulnerable REST API endpoint is accessible: curl -s "http://target.com/wp-json/mrm/v1/wp/admins?term=@"
3. Enumerate email addresses: Use search terms to retrieve email addresses matching common patterns:
   • curl -s "http://target.com/wp-json/mrm/v1/wp/admins?term=@" (returns all emails containing @)
   • curl -s "http://target.com/wp-json/mrm/v1/wp/admins?term=.com" (returns .com emails)
   • curl -s "http://target.com/wp-json/mrm/v1/wp/admins?term=gmail" (returns Gmail addresses)
4. Harvest results: Parse the JSON API response to extract user email addresses, including administrator accounts, for use in downstream attacks such as phishing or credential stuffing (WPScan).

• Network: Unusual or repeated unauthenticated HTTP GET requests to /wp-json/mrm/v1/wp/admins with query parameters such as ?term=@, ?term=.com, or ?term=gmail from external IP addresses.
• Logs: WordPress access logs showing high-frequency requests to the mrm/v1/wp/admins REST API endpoint from a single or rotating set of IP addresses, particularly without any associated authentication cookies or nonces.
• Logs: HTTP 200 responses to the above endpoint from unauthenticated sessions, indicating successful data retrieval.

Update the Mail Mint WordPress plugin to version 1.19.5 or later, which introduces proper authorization checks on the affected REST API endpoint. No configuration-based workaround is available short of disabling the plugin entirely. Site administrators should also audit their WordPress REST API exposure and consider using a web application firewall (WAF) rule to block unauthenticated access to /wp-json/mrm/v1/wp/admins as a temporary measure (WPScan).

The vulnerability was discovered and reported by researcher Yiğit İbrahim Sağlam (ibrahimsql) and verified by WPScan. The issue received standard community coverage through automated CVE tracking accounts on Bluesky and Nitter. ProjectDiscovery added Nuclei detection templates for this CVE, reflecting routine security tooling adoption for WordPress plugin vulnerabilities of this class (WPScan, Nuclei Templates).