WordPress Mailgun for WordPress plugin < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription vulnerability

Unauthenticated Arbitrary Mailgun List Subscription vulnerability discovered by Pedro Pinho in WordPress Plugin Mailgun for WordPress versions 2.2.1...

CVE-2026-14834

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...

WordPress WP Mailgun SMTP Plugin <= 1.0.7 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Legion Hunter in WordPress Plugin WP Mailgun SMTP versions = 1.0.7...

WordPress WP Mailgun SMTP plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin WP Mailgun SMTP versions = 1.0.7...