CVE-2026-14834 Mailgun CVE debrief

Who should care

WordPress site owners using the Mailgun for WordPress plugin, security teams monitoring for potential mailing list abuse, and developers responsible for maintaining the plugin should be aware of this vulnerability and take steps to mitigate it. Site owners should verify the version of the plugin being used and update to a patched version if necessary. Security teams should monitor mailing list subscriptions for suspicious activity and developers should review the plugin's code to ensure that it is secure.

Technical summary

The Mailgun for WordPress plugin before 2.2.1 has a vulnerability allowing unauthenticated attackers to add arbitrary email addresses to mailing lists using the owner's stored API credentials. This vulnerability exists due to a lack of capability and nonce checks on an unauthenticated AJAX action. The vulnerability can be exploited by sending a crafted request to the AJAX action, allowing an attacker to add arbitrary email addresses to the mailing list.

Defensive priority

Medium priority due to unauthenticated AJAX action vulnerability

Recommended defensive actions

• Verify and update the Mailgun for WordPress plugin to version 2.2.1 or later
• Restrict access to the AJAX action to authenticated users with necessary capabilities
• Monitor mailing list subscriptions for suspicious activity
• Consider implementing additional security measures such as API key rotation and limited mailing list permissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials. Evidence from the NVD and WPScan suggests that the Mailgun for WordPress plugin has a vulnerability allowing unauthenticated attackers to add arbitrary email addresses to mailing lists. The vulnerability has been reported to be fixed in version 2.2.1 or later. Defenders should verify the version of the plugin being used and update to a patched version if necessary.

Official resources