Advisory (from the source map)

PHP Object Injection is maybe_unserialize on contact meta, not an ajax action=. HTTP is REST mint-form-submit. PHP method names are not action=.

Entry

• Method: POST
• Path: /?rest_route=/mint-mail/v1/mint-form-submit
• Router: REST mint-mail/v1/mint-form-submit (FormSubmissionController::mrm_submit_form). permission_callback is always true. wp_nonce is wp_rest (uid 0). post_data is query-string form fields.
• Notes: CVE-2026-84753 CWE-502: unauthenticated form fields are stored as contact meta, then ContactModel::safe_unserialize_meta() maybe_unserialize()s them (objects instantiate before the is_array discard). 1.31.1 rejects is_serialized() input and uses allowed_classes=>false. Lab seed inserts mint_forms id=1 and page slug mm-lab-nonce with MM_NONCE=. Submit twice with the same email so the second request hits ContactModel::get. Witness is the unique class name POCWitness84753 in a 500/JSON error or debug.log — not a reverse shell. First POST stores the payload; second POST unserializes it.

Call chain

• GET /?rest_route=/wp/v2/pages&slug=mm-lab-nonce → MM_NONCE
• POST mint-mail/v1/mint-form-submit post_data email+form_id+serialized extra field
• FormAction::handle_form_submission stores meta verbatim (FormAction.php:58-64, 265)
• second POST existing contact → ContactModel::get → safe_unserialize_meta maybe_unserialize (ContactModel.php:1552-1557)
• object __wakeup/__destruct / unknown class error

Lab preconditions

• WordPress with mail-mint 1.31.0 active
• mint_forms row id=1 status published
• Public MM_NONCE= wp_rest nonce for uid 0
• Double opt-in disabled so WPMailMailer is_plugin_active() does not fatal before meta store
• Lab mu-plugin canary class POCWitness84753 (wakeup/destruct log the name; not a gadget chain)

Witness

Response or debug.log contains POCWitness84753 (unknown class during unserialize). Theme HTML, nonce bot message, or success JSON with no class error is not the object-injection witness.

Not success

• generic 200 hello world HTML
• Seems like you are a bot
• Form is not valid / Email Field Not found
• status success without unserialize error (payload never instantiated)
• reverse shell or outbound connect

Patch / remediation

Do this first: Update Mail Mint to 1.31.1 or newer.

Verify after upgrade

• Re-run CVE-2026-84753-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

• lab/docker-compose.yml
• lab/docker-compose.override.yml
• lab/Dockerfile

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

• CVE-2026-84753 · NVD

• CVE-2026-84753 · CVE.org

• patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-31-0-php-object-injection-vulnerability?_s_id=cve

• github.com/advisories/GHSA-28vg-wv39-3g8h

• nvd.nist.gov/vuln/detail/CVE-2026-84753

• Plugin directory: mail-mint

• Trac browser: plugins.trac.wordpress.org/mail-mint

• SVN tags: plugins.svn.wordpress.org/mail-mint

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null