CVE-2026-84755 carries a CVSS 3.1 base score of 6.5 against Mail Mint, a WordPress email marketing plugin by WPFunnels. NVD classifies it as CWE-862 (Missing Authorization) and states the flaw affects versions up to and including 1.31.0. VulnCheck’s KEV feed reports the CVE as exploited, dated September 3, 2026.
That exploitation report is single-sourced. CISA has not added CVE-2026-84755 to its Known Exploited Vulnerabilities catalog as of our most recent CISA KEV ingestion. No Binding Operational Directive 26-04 remediation obligation follows from a VulnCheck-only listing.
What the flaw is
NVD’s description for this CVE is brief: “Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.” NVD does not name the specific endpoint or capability check responsible; Patchstack’s vulnerability database entry, cited from NVD’s own reference list, is the only additional public source we currently have, and our source data does not carry deeper mechanism detail from it. The CVSS vector confirms this requires no authentication or user interaction (PR:N, UI:N).
Evidence and confidence
- Medium confidence — the CVSS 6.5 score, the vector (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), and the CWE-862 classification, which trace to NVD alone in our current ingestion, with a corroborating listing from Patchstack. The exploitation report traces to VulnCheck KEV alone. - Low exploitation probability — FIRST’s EPSS model scores this CVE at 0.00194, a 9.4th percentile score as of our ingestion.
No field is in conflict between our two sources.
Why this matters
Email marketing plugins like Mail Mint typically hold subscriber lists, campaign content, and automation rules — data an unauthenticated broken-access-control flaw could expose or manipulate depending on the specific endpoint involved, though our source data doesn’t carry that level of detail. Even without a full technical breakdown, the combination of “unauthenticated” and “broken access control” in NVD’s own summary is enough to warrant prompt patching for any site collecting subscriber or campaign data through this plugin.
Frequently Asked Questions
What is CVE-2026-84755? A CVSS 6.5 missing-authorization vulnerability (CWE-862) in the Mail Mint WordPress plugin by WPFunnels, affecting versions up to and including 1.31.0, described by NVD as unauthenticated broken access control.
Is CVE-2026-84755 being actively exploited? VulnCheck’s KEV feed reports it exploited, dated September 3, 2026. That report is single-sourced; CISA has not listed this CVE in its own Known Exploited Vulnerabilities catalog as of our current ingestion, and we have no independent corroboration.
Do I need an account to exploit this?
No. Both NVD’s description and the CVSS vector’s PR:N confirm this is exploitable without authentication.
Does this create a federal patching deadline? No. Directive 26-04 obligations follow CISA KEV listing, and this CVE is not CISA-listed.
Is a fixed version available? Our source data does not carry a specific fixed-version number beyond NVD’s statement that versions “up to, and including, 1.31.0” are affected. Consult the plugin vendor directly for the current patched release.
Severity, vector, and weakness classification sourced from the National Vulnerability Database record for CVE-2026-84755, corroborated by Patchstack’s vulnerability database entry. Exploitation status and the September 3, 2026 catalog date reported by VulnCheck KEV. This CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog as reflected in our current ingestion. EPSS score and percentile from FIRST’s Exploit Prediction Scoring System. Aggregated September 20, 2026. See more vulnerability intelligence.