Critical SSRF in Mailgun for WordPress Enables Admin Account Takeover
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Aug 23, 2026
A critical unauthenticated server-side request forgery flaw, tracked as CVE-2026-78003, was disclosed in the Mailgun for WordPress plugin and affects versions through 2.2.0. The bug stems from insufficient validation in the plugin's add_list() function, allowing attacker-controlled array keys to trigger path traversal and redirect authenticated Mailgun API requests to attacker-controlled endpoints. The issue carries a CVSS 3.1 score of 9.8 and affects a plugin reported to have more than 80,000 active installations.
Attackers can exploit the flaw to create malicious inbound email-forwarding routes, intercept password reset messages, and ultimately seize WordPress administrator accounts. A fix is available in 2.2.1, and defenders were urged to update immediately, rotate Mailgun API keys, and inspect Mailgun routes and mailing-list settings for unauthorized changes. Public detection coverage is also emerging, with a Nuclei template for CVE-2026-78003 submitted to the ProjectDiscovery templates repository.
