CVE-2026-14834

Name of the Vulnerable Software and Affected Versions Mailgun for WordPress versions prior to 2.2.1

Description An unauthenticated AJAX action fails to perform capability or nonce checks. This allows unauthenticated attackers to enroll arbitrary email addresses into the site owner's configured email service mailing lists by leveraging the owner's stored API credentials. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source.

Recommendations Update to version 2.2.1 or later.