CVE-2026-78003: Mailgun for WordPress Plugin SSRF Vulnerability

CVE-2026-78003 Overview

CVE-2026-78003 is a Server-Side Request Forgery (SSRF) vulnerability in the Mailgun for WordPress plugin, affecting all versions up to and including 2.2.0. The flaw resides in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and processes them only through sanitize_text_field(). Path traversal sequences in these keys allow unauthenticated attackers to redirect requests to arbitrary Mailgun API endpoints using the WordPress site's stored API key. Attackers can create inbound email-forwarding routes, intercept password reset emails, and take over administrator accounts [CWE-918].

Critical Impact
Unauthenticated attackers can hijack the site's Mailgun API credentials to forward inbound email, intercept password resets, and achieve full administrator account takeover.

Affected Products

Mailgun for WordPress plugin versions up to and including 2.2.0
WordPress installations with the Mailgun plugin activated and a configured API key
Sites relying on Mailgun-delivered password reset or transactional email

Discovery Timeline

2026-08-22 - CVE-2026-78003 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78003

Vulnerability Analysis

The Mailgun for WordPress plugin exposes an AJAX-reachable handler that ultimately calls add_list(). This function reads the $_POST['addresses'] array and uses its keys to construct the request path sent to the Mailgun API. Because keys are only filtered through sanitize_text_field(), which strips control characters but preserves ../ sequences and slashes, an attacker can pivot the outbound request to any endpoint under the Mailgun API namespace. The plugin then authenticates the pivoted request using the WordPress site's stored Mailgun API key. This transforms a client-supplied identifier into an authenticated server-side request against Mailgun's control plane.

Root Cause

The root cause is insufficient input validation on user-controlled array keys used to build an outbound API path. sanitize_text_field() is designed to normalize text content, not to validate path components. The plugin never enforces an allow-list of endpoints or rejects traversal characters, so untrusted input directly influences the request URI passed to the Mailgun API client.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to the vulnerable plugin endpoint. The request includes an addresses parameter whose array keys contain path traversal sequences that resolve to a different Mailgun API resource, such as the inbound routes endpoint. The plugin appends the site's authenticated Mailgun credentials and forwards the request. The attacker uses this primitive to create an inbound forwarding route that mirrors messages for the site's administrator address to an attacker-controlled inbox, then triggers the WordPress password reset flow to seize the administrator account. Technical references are available in the Wordfence Vulnerability Analysis and the WordPress Mailgun plugin source.

Detection Methods for CVE-2026-78003

Indicators of Compromise

POST requests to the Mailgun plugin AJAX handler containing addresses[ keys with ../, %2f, or %2e%2e sequences.
Unexpected inbound routes appearing in the Mailgun control panel, especially routes forwarding to external domains.
Successful WordPress administrator password reset events without a corresponding user-initiated request in application logs.
Outbound HTTPS requests from the WordPress host to api.mailgun.net paths outside the plugin's normal /lists usage.

Detection Strategies

Inspect web server access logs for POST bodies referencing the plugin's endpoint with traversal characters in addresses keys.
Correlate WordPress password_reset events with mail delivery records to identify resets whose confirmation emails were forwarded externally.
Audit the Mailgun account's inbound route configuration and compare against a known-good baseline.

Monitoring Recommendations

Alert on any creation or modification of Mailgun inbound routes via the API.
Log and review all administrator role assignments and password changes in WordPress.
Monitor outbound HTTP requests from PHP workers for anomalous Mailgun API paths.

How to Mitigate CVE-2026-78003

Immediate Actions Required

Update the Mailgun for WordPress plugin to a version newer than 2.2.0 as soon as a fixed release is available.
Rotate the Mailgun API key configured in the plugin, since it may have been abused for unauthorized API calls.
Review and delete any unrecognized inbound routes in the Mailgun account.
Force password resets for all WordPress administrator accounts and enable multi-factor authentication.

Patch Information

At the time of publication, the vendor advisory references code in versions up to and including 2.2.0. Administrators should consult the WordPress Mailgun plugin repository and the Wordfence Vulnerability Analysis for patch status and apply the fixed release once published.

Workarounds

Deactivate the Mailgun for WordPress plugin until a patched version is installed.
Restrict access to the plugin's AJAX endpoint using a web application firewall rule that blocks traversal characters in addresses array keys.
Scope the Mailgun API key using Mailgun's domain-level permissions so it cannot manage account-wide routes.

bash

# Example WAF rule to block traversal in addresses keys
SecRule ARGS_NAMES "@rx addresses\[[^\]]*(\.\./|%2e%2e|%2f)" \
    "id:1026780,phase:2,deny,status:403,\
    msg:'CVE-2026-78003 Mailgun plugin SSRF traversal attempt'"