The Mailgun for WordPress plugin allows an attacker without authentication to add any email address to the site owner's configured Mailgun mailing lists using the stored API credentials. Because the plugin's AJAX "add_list" action performs no capability or nonce verification, the adversary can enroll arbitrary third‑party addresses. This creates a channel to send unsolicited emails, enabling spam or phishing campaigns that can damage the site’s reputation.

WordPress sites running the Mailgun for WordPress plugin with a version older than 2.2.1 are subject to this vulnerability. The issue exists as long as the plugin is active and stores API credentials for a Mailgun service.

The flaw can be exploited by simply sending a crafted HTTP request to the site; no code execution or privilege escalation is required. The CVSS score of 6.5 reflects the potential for widespread abuse through mass mailing. However, the EPSS score is below 1%, indicating a low but nonzero probability of exploitation today, and it is not listed in the CISA KEV catalog. Nonetheless, because the attacker gains full control of the site owner's mailing list, the threat to communication integrity and brand reputation remains significant.