SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-78003 2026-08-22

CVE-2026-78003: Unauthenticated SSRF in Mailgun for WordPress

"A server-side request forgery flaw in the Mailgun for WordPress plugin, scored critical (CVSS 9.8) by the reporting CNA, lets unauthenticated attackers hijack a site's Mailgun API key; plausibly enabling mail-forwarding…"

A server-side request forgery flaw in the Mailgun for WordPress plugin, scored critical (CVSS 9.8) by the reporting CNA, lets unauthenticated attackers hijack a site's Mailgun API key; plausibly enabling mail-forwarding routes and administrator account seizure.

What Is It

CVE-2026-78003 is a Server-Side Request Forgery vulnerability (CWE-918) reachable via path traversal in the Mailgun for WordPress plugin. The root cause is insufficient input validation in the plugin's add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes them through sanitize_text_field(), sanitization that does not prevent traversal into arbitrary API paths.

Because the plugin appends the attacker-controlled value to the outbound request path, an unauthenticated attacker can make authenticated POST requests to any Mailgun API endpoint using the WordPress site's stored API key. No credentials, no privileges, and no user interaction are required.

Why It Matters

The CVSS 3.1 base score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, comes from Wordfence as the assigning CNA. NVD has not yet completed its own analysis, the record remains in Received status, so this score should be read as the CNA's assessment rather than an NVD-confirmed figure. On its terms, the vector describes a network-attackable, low-complexity issue requiring no privileges, with high impact across confidentiality, integrity, and availability.

The most consequential attack path runs toward full site compromise. An attacker who controls arbitrary Mailgun API calls could plausibly create inbound email-forwarding routes on the victim's Mailgun account, intercept password reset emails, and from there attempt an administrator account takeover. That chain is an inference from the plugin's capability rather than a publicly demonstrated exploit, and it depends on the victim's Mailgun configuration and the site's password-reset flow. Control of the site's mail infrastructure would also imply visibility into any other mail routed through it.

CVE-2026-78003 does not appear in CISA's Known Exploited Vulnerabilities catalog, and no public reporting reviewed here documents in-the-wild exploitation. Active exploitation is therefore unconfirmed at this time.

What's Vulnerable

Patch Status

The NVD record was published 2026-08-22 in Received status and lists no fixed version and no required-action guidance; the Wordfence advisory likewise identifies no patched release. Until a fixed version ships, operators running 2.2.0 or earlier should treat the plugin as exposed. Because the flaw abuses the stored Mailgun API key, rotating that key is a reasonable containment step, alongside monitoring the Mailgun account for unexpected inbound routes and reviewing WordPress administrator accounts for unfamiliar additions.

Sources