What is CVE-2026-2025?

CVE-2026-2025 is a high-severity vulnerability in Mail Mint, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-03-04.

How severe is CVE-2026-2025?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Mail Mint

CVE-2026-2025

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

Vulnerability class: Information Disclosure

EPSS: 0.014 (69.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Unknown Mail Mint — versions 0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-2025?: CVE-2026-2025 is a high-severity vulnerability in Mail Mint, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-03-04.
How severe is CVE-2026-2025?: High severity. CVSS v3 base score is 7.5 out of 10.