This critical vulnerability allows unauthenticated attackers to achieve remote code execution on WordPress sites using the Mail Mint plugin through insecure deserialization.

The plugin suffers from an unauthenticated PHP object injection flaw (CWE-502), which occurs due to the improper deserialization of untrusted data. An attacker can supply malicious serialized objects to the application, resulting in remote code execution with the privileges of the web server.

The exploitation of this vulnerability poses a severe risk to organizational assets, as it grants attackers full control over the affected WordPress instance. Given the CVSS score of 9.8, this flaw could lead to complete data exfiltration, unauthorized administrative access, and potential lateral movement into the hosting environment.

Immediate Action: Update the Mail Mint plugin to version 1.31.1 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Review web server access logs for unusual POST requests containing serialized PHP objects or unexpected strings in plugin-specific endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized input strings until the plugin can be updated.

Public Exploit Available: Unknown

Due to the critical severity and the potential for unauthenticated remote code execution, this vulnerability represents an urgent security priority. Administrators must verify their current plugin version and apply the mandatory update to version 1.31.1 without delay to prevent potential exploitation.