Cyber Resilience

CVE-2026-2025

High

Published: 04 March 2026

Published
04 March 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.2881 96.7th percentile
Risk Priority 32 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2025 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).

Deeper analysis

The Mail Mint WordPress plugin before version 1.19.5 contains an authorization flaw in one of its REST API endpoints. The issue is tracked as CVE-2026-2025 with a CVSS v3.1 score of 7.5 and is classified under CWE-200 for exposure of sensitive information. Unauthenticated callers can invoke the endpoint and obtain email addresses stored for users of the affected blog.

An attacker with network access can exploit the missing authorization controls without authentication or user interaction to enumerate subscriber or user email addresses. The attack requires only a standard HTTP request to the exposed REST route and results in high-impact confidentiality loss while leaving integrity and availability unaffected.

The referenced WPScan advisory identifies the affected plugin versions and indicates that the issue is resolved by updating to Mail Mint 1.19.5 or later. The associated EPSS score has risen from a low baseline to a peak of 0.3396 (current value 0.2881), indicating emerging exploitation interest after disclosure.

EU & UK References

Vulnerability details

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

CWE(s)
CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1087.003 Email Account Discovery
Adversaries may attempt to get a listing of email addresses and accounts.
attack.mitre.org →
T1589.002 Email Addresses Reconnaissance
Adversaries may gather email addresses that can be used during targeting.
attack.mitre.org →
Why these techniques?

Direct remote unauthenticated exploitation of public-facing WordPress REST endpoint (T1190) enabling collection of email addresses (T1087.003/T1589.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-25222Shared CWE-200
CVE-2024-13796Shared CWE-200
CVE-2025-25975Shared CWE-200
CVE-2024-12142Shared CWE-200
CVE-2025-25951Shared CWE-200
CVE-2026-34297Shared CWE-200
CVE-2024-26480Shared CWE-200
CVE-2026-24498Shared CWE-200
CVE-2025-22828Shared CWE-200
CVE-2026-23659Shared CWE-200

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces authorization checks on the Mail Mint plugin's REST API endpoint, directly preventing unauthenticated users from retrieving sensitive user email addresses.

AC-22 Publicly Accessible Content good match
prevent

Restricts public access to sensitive content such as user email addresses exposed via publicly accessible WordPress REST API endpoints.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like the missing authorization in Mail Mint plugin versions prior to 1.19.5.

References