EUVD-2026-51413
GHSA-xgf9-46hc-5c98
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible unauthenticated endpoint with no data read by attacker (C:N); only mailing list integrity is affected (I:L); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.
AnalysisAI
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Mailgun for WordPress plugin must be installed, active, and running at a version below 2.2.1 on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N accurately reflects that exploitation is remote, requires no authentication, and carries low complexity - the attack surface is broad and accessible to any attacker who can identify a vulnerable WordPress installation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for WordPress installations running the vulnerable Mailgun plugin (versions below 2.2.1), then sends a crafted unauthenticated HTTP POST request to wp-admin/admin-ajax.php with the target mailing list and victim email address as parameters. The server processes the request through the unguarded AJAX handler, using the site owner's stored Mailgun API credentials to silently enroll the victim address in the specified list. … |
| Remediation | Update the Mailgun for WordPress plugin to version 2.2.1 or later immediately, as this is the vendor-confirmed patched release that introduces proper capability and nonce validation on the affected AJAX action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mailgun For Wordpress
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today