CVE-2026-14834 is an improper access control vulnerability (CWE-284) in the Mailgun for WordPress plugin before version 2.2.1. The flaw exists because the plugin does not verify user capabilities or nonces on an AJAX action that adds subscribers to mailing lists. As a result, unauthenticated attackers can exploit this to enroll arbitrary email addresses into the site owner's mailing lists leveraging the stored API credentials.

An attacker can add arbitrary email addresses to the site owner's mailing lists without authentication. This could lead to abuse such as spam or unwanted subscriptions, potentially damaging the reputation of the site owner or causing operational issues with mailing list management. The confidentiality and integrity of the mailing list data are impacted, but there is no indication of denial of service or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site owners should consider disabling the vulnerable AJAX action or restricting access to it via other means. Monitoring for unusual subscription activity may help detect exploitation attempts.