A critical PHP Object Injection vulnerability in the Mail Mint WordPress plugin allows unauthenticated attackers to achieve remote code execution on the server.

This vulnerability occurs due to insecure deserialization of untrusted input within the handle_form_submission function. An unauthenticated attacker can supply a malicious PHP object, which, when combined with a POP chain, results in arbitrary code execution.

The exploitation of this vulnerability poses a severe risk to organizational security, as it grants unauthenticated attackers full control over the affected WordPress instance. With a CVSS score of 9.8, this flaw facilitates complete data compromise, potential lateral movement within the hosting environment, and significant operational disruption.

Immediate Action: Update the Mail Mint plugin to version 1.31.1 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Audit server access logs for suspicious POST requests directed at the handle_form_submission endpoint or unusual patterns related to object serialization strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection payloads and unauthorized attempts to access plugin-specific form submission endpoints.

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB) available.

Given the critical severity of this vulnerability and the potential for full system compromise, administrators must prioritize the update to version 1.31.1 across all production environments. Failure to patch this plugin provides an open vector for remote code execution, making immediate remediation essential to maintaining the integrity and confidentiality of the web infrastructure.