CVE-2026-14834 — Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

CVE-2026-14834

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX PUBLISHED

Description (CNA)

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

Affected (CNA)

Vendor / product	Versions
Unknown / Mailgun for WordPress	affected 0 before 2.2.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/84135fff-e602-4773-8e79-a831284de0d2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.