The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is d…
Medium CVSS 6.5
Summary
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls d…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Controllers/Admin/SegmentController.php#L41
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Routes/Admin/SegmentRoute.php#L55
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L100
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L297
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L500
- https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L797
- https://plugins.trac.wordpress.org/changeset/3743638/mail-mint/trunk/app/Internal/Admin/Segmentation/SegmentFilterService.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=cve
Timeline
- nvd_ingest NVD