Mailgun for WordPress CVE-2026-14834

The Mailgun for WordPress plugin must be installed, active, and running at a version below 2.2.1 on the target WordPress site. The plugin must be configured with valid Mailgun API credentials and have at least one mailing list set up - the unprotected AJAX action specifically targets the list subscription feature. No authentication is required from the attacker (confirmed by CVSS PR:N and the description's explicit statement of 'unauthenticated AJAX action'). Exploitation does not grant the attacker read access to existing subscriber data, WordPress administrative functions, or the underlying Mailgun account credentials - the impact is limited strictly to unauthorized enrollment of supplied email addresses into the configured list. Sites with the Mailgun plugin installed but not configured with a mailing list may be unaffected by the worst-case impact, though the unprotected endpoint remains exposed.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N accurately reflects that exploitation is remote, requires no authentication, and carries low complexity - the attack surface is broad and accessible to any attacker who can identify a vulnerable WordPress installation. However, the bounded impact (no code execution, no admin privilege escalation, no direct data exfiltration) limits this to a medium-severity rating rather than critical. The EPSS score of 0.14% (4th percentile) is notably low despite a public exploit being available, suggesting the vulnerability is known but has not attracted widespread automated exploitation. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in targeted campaigns at time of analysis. The NVD vector assigns C:L, which may reflect indirect exposure of API credential use; however, the description does not indicate the attacker gains visibility into existing subscriber data or API keys, making C:L a borderline attribution. The real-world risk is primarily reputational and legal - site owners may face liability for unsolicited email enrollment of third-party addresses using their Mailgun accounts.

An attacker scans for WordPress installations running the vulnerable Mailgun plugin (versions below 2.2.1), then sends a crafted unauthenticated HTTP POST request to wp-admin/admin-ajax.php with the target mailing list and victim email address as parameters. The server processes the request through the unguarded AJAX handler, using the site owner's stored Mailgun API credentials to silently enroll the victim address in the specified list. A public exploit is available from WPScan, making this a low-skill, scriptable attack suitable for bulk targeting of vulnerable WordPress sites.