Loading story…
A critical unauthenticated server-side request forgery flaw, tracked as CVE-2026-78003, was disclosed in the Mailgun for WordPress plugin and affects versions through 2.2.0. The bug stems from insufficient validation in the plugin's add_list() function, allowing attacker-controlled array keys to trigger path traversal and redirect authenticated Mailgun API requests to attacker-controlled endpoints. The issue carries a CVSS 3.1 score of 9.8 and affects a plugin reported to have more than 80,000 active installations.
Attackers can exploit the flaw to create malicious inbound email-forwarding routes, intercept password reset messages, and ultimately seize WordPress administrator accounts. A fix is available in 2.2.1, and defenders were urged to update immediately, rotate Mailgun API keys, and inspect Mailgun routes and mailing-list settings for unauthorized changes. Public detection coverage is also emerging, with a Nuclei template for CVE-2026-78003 submitted to the ProjectDiscovery templates repository.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request added a Nuclei template for CVE-2026-78003, associated with change identifier 5cda16f. The repository workflow also shows review activity around the template addition.
The Mailgun for WordPress plugin fixed CVE-2026-78003 in version 2.2.1. The vulnerability affects versions up to and including 2.2.0.
Osvaldo Noe Gonzalez Del Rio discovered CVE-2026-78003, a critical unauthenticated SSRF vulnerability in the Mailgun for WordPress plugin, and the issue was reported through Wordfence. The source does not anchor a date for the discovery or report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-4020** in the RocketGenius **Gravity SMTP** WordPress plugin to extract sensitive configuration data and live email-service credentials from vulnerable sites. The flaw affects versions **2.1.4 and earlier** and stems from an unauthenticated REST API endpoint, `/wp-json/gravitysmtp/v1/tests/mock-data`, whose permission check always returns true; when queried with `page=gravitysmtp-settings`, it can return a detailed JSON system report containing environment data, API keys, secrets, and OAuth tokens tied to providers including **Amazon SES, Google, Mailjet, Resend, and Zoho**. The plugin is installed on roughly **100,000** WordPress sites, raising the risk of credential theft and abuse of legitimate outbound email infrastructure for spam, phishing, or follow-on compromise. **Wordfence** said it blocked more than **17 million** exploitation attempts, including a spike of over **4 million** in a single day, while **CrowdSec** observed at least **412** attacking IPs during earlier scanning and attack activity. RocketGenius released a fix in **Gravity SMTP 2.1.5**, and defenders are being urged to update immediately, rotate any potentially exposed credentials, and review logs for suspicious requests to the vulnerable endpoint.
Jun 29, 2026
Multiple critical flaws in widely deployed WordPress plugins exposed sites to administrator takeover through broken REST API authorization, weak JWT handling, and sensitive data leakage. In **Post SMTP**, `CVE-2025-24000` let any authenticated user read administrator-only email logs in versions through `3.2.0`, while `CVE-2025-11833` extended similar exposure to unauthenticated attackers in versions through `3.6.0`; because password reset messages were stored in those logs, attackers could reset admin passwords and seize control of affected sites. **RestroPress** (`CVE-2025-9209`) exposed user tokens through `/wp-json/wp/v2/users`, enabling forged JWTs and full admin access, and **miniOrange OAuth SSO** (`CVE-2025-9485`) accepted forged JWTs because signatures were not verified, allowing login as arbitrary users including administrators. **Copypress Rest API** (`CVE-2025-8625`) combined a hard-coded JWT signing key with unrestricted file upload to enable unauthenticated remote code execution. The pattern continued into active exploitation of **Gravity SMTP** (`CVE-2026-4020`), where an unauthenticated REST API endpoint exposed system reports containing WordPress and server details, plugin inventories, database information, and email-service credentials such as API keys, secrets, and OAuth tokens. Wordfence said exploitation required only a single request, reported blocking more than **17 million** attempts, and urged defenders to upgrade to `2.1.5` and rotate exposed third-party email credentials. Across the affected plugins, vendors issued fixes including **Post SMTP 3.3.0**, **miniOrange 6.26.13**, and **Gravity SMTP 2.1.5**, while the Copypress plugin was temporarily closed; the incidents underscore how exposed REST endpoints and flawed token validation can quickly turn routine plugin features into full site compromise paths.
Jun 29, 2026
A critical vulnerability in the *Post SMTP* WordPress plugin, tracked as CVE-2025-11833, has exposed over 400,000 WordPress sites to potential account and website takeover. The flaw, present in all plugin versions up to and including 3.6.0, stems from missing capability checks in the `__construct` function, allowing unauthenticated attackers to reset passwords for any user, including administrators. Wordfence, which received the initial bug report via its bounty program, has already blocked more than 4,500 attack attempts, and exploitation activity has accelerated since early November. Security researchers warn that at least 210,000 sites remain at risk, with attackers leveraging the vulnerability to access password reset messages and hijack admin accounts. Website owners are strongly advised to update to the patched version released on October 29 or disable the plugin to prevent compromise. The incident follows a previous security issue (CVE-2025-24000) affecting the same plugin, highlighting ongoing risks for sites relying on outdated or unpatched WordPress extensions.
Jun 29, 2026