CVE-2026-14834
Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.
| Vendor | unknown |
| Product | mailgun for wordpress |
| Published | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown mailgun for wordpress
Be the first to know when new unknown vulnerabilities affecting unknown mailgun for wordpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Mailgun for WordPress
0 < 2.2.1
References
Credits
Pedro Pinho WPScan