CVE-2026-78003: Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist() function, which accepts user-controlled array keys from $POST['addresses'], passes them through sanitizetextfield(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mailgun for WordPressto a version that resolves this vulnerability.Fixed in 2.2.0 - Compensating control
Because the vulnerability is exploitable via unauthenticated attackers by making authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, restrict/mitigate unauthenticated access to the Mailgun for WordPress handler endpoints (e.g., via WAF/ACL limiting ability to submit POST requests to the vulnerable function) until the plugin is updated.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An unauthenticated remote attacker can submit crafted values through the affected addresses input.
Which sites are exposed?
WordPress sites running Mailgun for WordPress version 2.2.0 or earlier are affected. Exploitation relies on the site having a Mailgun API key available to the plugin, because requests are made using that key.
What can an attacker do with the Mailgun API access obtained through this flaw?
The attacker can cause authenticated POST requests to Mailgun API endpoints. The described impact includes creating inbound email-forwarding routes that intercept password-reset messages and can enable WordPress administrator account takeover.
How can defenders identify possible exploitation?
Review Mailgun configuration and API activity for unexpected authenticated POST requests, particularly newly created inbound email-forwarding routes. Also investigate unexpected password-reset activity or administrator account changes on the associated WordPress site.