CVE-2026-78003
CRITICAL
9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
918
Server-Side Request Forgery (SSRF)
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Potential Impacts:
Read Application Data
Execute Unauthorized Code Or Commands
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Web Based, AI/ML, Web Server
https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L259
https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L323
https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L331
https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L557
https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L259
https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L323
https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L331
https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L557
https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b9…