Executive brief
The Mailgun for WordPress plugin, which connects WordPress sites to the Mailgun email service, contains a security flaw in how it handles new subscriber requests. An unauthorized person can exploit this to add any email address to the website owner's mailing lists without permission. This could lead to the mailing list being filled with spam or unauthorized contacts, potentially damaging the sender's reputation or increasing service costs.
Technical details
The Mailgun for WordPress plugin fails to implement proper access controls or CSRF protection (nonces) on its 'add_list' AJAX action. This endpoint is intended to allow users to subscribe to mailing lists via a widget, but because it lacks authentication checks, a remote attacker can send unauthenticated POST requests to wp-admin/admin-ajax.php to enroll arbitrary email addresses. The plugin uses the site owner's stored Mailgun API credentials to perform these actions on the backend. Attackers can identify target mailing list addresses through the public widget HTML or by guessing common naming patterns. The issue is resolved in version 2.2.1.
Affected products
- Mailgun Mailgun for WordPress < 2.2.1
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-13: patched: Fixed in version 2.2.1