CVE-2026-78003

Name of the Vulnerable Software and Affected Versions Mailgun for WordPress versions prior to 2.2.1

Description Insufficient input validation in the add list() function allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) via path traversal. The issue occurs because the function accepts user-controlled array keys from the addresses variable within the $ POST request and only processes them through sanitize text field(). This allows attackers to execute authenticated POST requests to any Mailgun API endpoint using the site's API key. This can be used to create inbound email-forwarding routes to intercept password reset emails, potentially resulting in the takeover of administrator accounts.

Recommendations Update the plugin to a version newer than 2.2.0. As a temporary mitigation, restrict access to the functionality utilizing the add list() function.