CVE-2026-10196

Name of the Vulnerable Software and Affected Versions Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails versions prior to 1.31.1

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input within the handle form submission() function. This allows unauthenticated attackers to inject a PHP Object, which, combined with a POP chain (a sequence of gadgets used to execute arbitrary code), enables remote code execution on the server.

Recommendations Update the plugin to a version later than 1.31.0. As a temporary mitigation, restrict access to the handle form submission() function.