CVE-2026-2025

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.38% chance of exploitation in the next 30 days, 70th percentile

Nuclei

high · CWE-200

Published

2026-03-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2025.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2026-20245
• CVE-2026-20251
• CVE-2026-20230
• CVE-2026-20253
• CVE-2026-20224
• CVE-2026-20262