| CVE | [CVE-2026-84753]( · [CVE.org]( |
| CWE | [CWE-502]( |
| CVSS | **Critical: 9.8** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Product | [Mail Mint]( |
| Affected | all versions **through 1.31.0** (inclusive) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
PHP Object Injection is maybe_unserialize on meta, not an ajax action=. HTTP is REST mint-form-submit. PHP method names are not action=.
- **Path:** `/?rest_route=/mint-mail/v1/mint-form-submit`
- **Router:** REST mint-mail/v1/mint-form-submit (FormSubmissionController::mrm_submit_form). permission_callback is always true. wp_nonce is wp_rest (uid 0). post_data is query-string form fields.
- **Notes:** CVE-2026-84753 CWE-502: unauthenticated form fields are stored as meta, then ContactModel::safe_unserialize_meta() maybe_unserialize()s them (objects instantiate before the is_array discard). 1.31.1 rejects is_serialized() input and uses allowed_classes=>false. Lab seed inserts mint_forms id=1 and page slug mm-lab-nonce with MM_NONCE=. Submit twice with the same email so the second request hits ContactModel::get. Witness is the unique class name POCWitness84753 in a 500/JSON error or debug.log — not a reverse shell. First POST stores the payload; second POST unserializes it.
- `GET /?rest_route=/wp/v2/pages&slug=mm-lab-nonce → MM_NONCE`
- `POST mint-mail/v1/mint-form-submit post_data email+form_id+serialized extra field`
- `FormAction::handle_form_submission stores meta verbatim (FormAction.php:58-64, 265)`
- `second POST existing → ContactModel::get → safe_unserialize_meta maybe_unserialize (ContactModel.php:1552-1557)`
- `object __wakeup/__destruct / unknown class error`
- Public MM_NONCE= wp_rest nonce for uid 0
- Double opt-in disabled so WPMailMailer is_plugin_active() does not fatal before meta store
- Lab mu-plugin canary class POCWitness84753 (wakeup/destruct log the name; not a gadget chain)
Response or debug.log contains POCWitness84753 (unknown class during unserialize). Theme HTML, nonce bot message, or success JSON with no class error is not the object-injection witness.
- Form is not valid / Email Field Not found
- status success without unserialize error (payload never instantiated)
**Do this first:** Update **Mail Mint** to **1.31.1 or newer**.
- Re-run `CVE-2026-84753-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a `Dockerfile` in this folder builds from source.
- [`lab/docker-compose.yml`](lab/docker-compose.yml)
- [`lab/docker-compose.override.yml`](lab/docker-compose.override.yml)
Bind the vulnerable product tree to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except `127.0.0.1`.
- [CVE-2026-84753 · NVD](
- [CVE-2026-84753 · CVE.org](
- [patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-31-0-php-object-injection-vulnerability?_s_id=cve](
- [github.com/advisories/GHSA-28vg-wv39-3g8h](
- [nvd.nist.gov/vuln/detail/CVE-2026-84753](
- Plugin directory: [mail-mint](
- Trac browser: [plugins.trac.wordpress.org/mail-mint](
- SVN tags: [plugins.svn.wordpress.org/mail-mint](
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
- input: `
Unauthenticated PHP Object Injection in Mail Mint
-
-
-
Unauthenticated PHP Object Injection in Mail Mint