CVE-2026-1258

The record

The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries.

Affected packages

Related vulnerabilities

• CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
• CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
• CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
• CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
• CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
• CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
• CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
• CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89