The Mail Mint WordPress plugin is vulnerable to an unauthenticated information exposure flaw that allows unauthorized retrieval of user email addresses.

This vulnerability involves a missing authorization check within a REST API endpoint, which permits unauthenticated users to access and extract sensitive user email data from the affected WordPress site.

The exploitation of this vulnerability leads to the unauthorized disclosure of sensitive user information, which can facilitate targeted phishing campaigns or further credential harvesting attacks against the organization. Given the CVSS score of 7.5, this is considered a high severity issue that requires immediate attention to protect user privacy and maintain regulatory compliance.

Immediate Action: Update the Mail Mint plugin to version 1.19.5 or later to resolve the authorization flaw.

Proactive Monitoring: Monitor server logs for suspicious or high frequency requests directed at REST API endpoints, particularly those originating from unauthorized or unusual IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict or block unauthorized access to the specific REST API endpoints associated with the Mail Mint plugin until the update can be applied.

Public Exploit Available: exploit_available (unknown)

Organizations utilizing the Mail Mint plugin must prioritize updating to version 1.19.5 immediately. Failure to patch this vulnerability exposes user contact information to unauthorized actors, creating a significant risk of follow-on social engineering attacks. If an immediate update is not feasible, restrict access to the plugin functionality or disable the plugin entirely until remediation is complete.