CVE-2026-78003
Received Received - Intake

Server-Side Request Forgery in Mailgun for WordPress Plugin

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: Wordfence

Description
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-78003
EUVD
EUVD-2026-64242

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailgun mailgun_for_wordpress to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mailgun for WordPress plugin has a Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation in the add_list() function. It accepts user-controlled array keys from POST data, which can be manipulated to make authenticated requests to any Mailgun API endpoint using the WordPress site's API key.

Detection Guidance

To detect this vulnerability, check if the Mailgun for WordPress plugin version 2.2.0 or lower is installed. Review server logs for unusual POST requests to Mailgun API endpoints or unexpected email-forwarding route creations. No specific commands are provided in the context.

Impact Analysis

Unauthenticated attackers can exploit this to create inbound email-forwarding routes that intercept password reset emails, leading to administrator account takeover. This could allow full control over the WordPress site.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, such as password reset emails, which may contain personal or protected health information. For GDPR, this could result in unauthorized processing or access to personal data, violating principles of data protection and user consent. For HIPAA, it may expose protected health information to unauthorized parties, leading to compliance breaches and potential penalties.

Mitigation Strategies

Immediately update the Mailgun for WordPress plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin. Review and revoke any unauthorized Mailgun API keys or email-forwarding routes. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78003. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart