CVE-2026-14834CWE-284broken-access-control

CVE-2026-14834

Medium · published July 31, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-31T11:16Z
References (1)
https://wpscan.com/vulnerability/84135fff-e602-4773-8e79-a831284de0d2/ · [email protected]
EPSS history
Timeline
  • 31 JUL 06:00Z
    Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX
    cvelistv5