Security Alert Summary
The Mailgun for WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability via path traversal in the add_list() handling of $_POST['addresses']. Insufficient input validation can allow unauthenticated attackers to make authenticated POST requests to Mailgun API endpoints using the site's API key, potentially creating inbound email-forwarding routes that could intercept password reset emails and lead to administrator account takeover.
CVE Details
- CVE ID: CVE-2026-78003
- Affected component: Mailgun for WordPress plugin
- Affected versions: Versions up to and including 2.2.0
- Published: August 22, 2026 at 9:16:53 AM
- Last modified: August 22, 2026 at 9:16:53 AM
- CVSS v3.1: Base Score 9.8, Severity CRITICAL
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User interaction: Authentication: None required; Privileges required: None; User interaction: None
- Scope: Unchanged
- Impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-918
Technical Details
The vulnerability is a Server-Side Request Forgery (SSRF) caused by insufficient input validation in the plugins add_list() code path. The function accepts user-controlled array keys from $_POST['addresses'] and passes those values through sanitize_text_field(). This sanitization does not prevent construction of requests that cause the server to issue authenticated POST requests to Mailgun endpoints using the stored Mailgun API key.
An unauthenticated attacker can exploit this behavior to interact with Mailgun API endpoints on behalf of the victim site. The reported impact includes the ability to create inbound email-forwarding routes at Mailgun, which could be used to intercept incoming messages such as password reset emails. The description links the SSRF and path traversal to potential administrator account takeover via intercepted emails.
How This Could Impact Your Website
Imagine a site owner, an internal content editor, and an external contractor who manages email integration. An unauthenticated attacker exploiting this SSRF could create Mailgun routing rules that forward incoming email intended for site users, including password reset messages, to an attacker-controlled address. This could allow the attacker to perform targeted phishing or to complete account recovery flows for administrative accounts if password reset emails are intercepted. Even if only a subset of accounts are affected, exposure of internal user email addresses increases the risk of targeted social engineering against staff and contractors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with elevated email or API access.
- Enforce strong passwords and enable two-factor authentication (2FA) for editor and administrator accounts.
- Remove unused or unmaintained plugins that have access to API keys or email configuration.
- Monitor site activity and Mailgun account activity for unusual behavior, such as unexpected route creation or API calls.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L259
- https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L323
- https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L331
- https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L557
- https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L259
- https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L323
- https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L331
- https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L557
- https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=cve
