CVE-2026-84753Critical· 9.8▾ AbyssalPoC available

Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score66/ 100 · Elevated

impact 53.9 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 3, 2026

Updated

Sep 5, 2026

CVSS

9.8

Vendor

—

Product

—

CWE

CWE-502

Depth score

66 · Elevated

EPSS

0.31% · p24

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

1 public repository

abraxas/CVE-2026-84753 ↗

EPSS history

Exploit-prediction probability, daily snapshots since Sep 5.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 17 days

Sep 3, 2026Published
Disclosed via NVD
Sep 5, 2026Record revised
Last analysed / modified upstream
Sep 5, 2026EPSS first tracked
0.3%
Sep 19, 2026Public exploit observed
1 GitHub repo

CWE-502 #nvd #exploit-available

Full technical detail▾

Overview

Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-31-0-php-object-injection-vulnerability?_s_id=cve

Change history

Field changes observed since this record was first indexed.

Sep 19, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available