Loading vulnerability…
Unauthenticated SSRF in Mailgun for WordPress add_list()
CVE-2026-78003 is a critical server-side request forgery vulnerability in the Mailgun for WordPress plugin affecting versions up to and including 2.2.0. The flaw is caused by insufficient input validation in the add_list() function, which accepts user-controlled array keys from POST-supplied address data and processes them with sanitize_text_field(), a control that does not prevent path traversal abuse in this context. By manipulating how the plugin constructs Mailgun API requests, an unauthenticated attacker can cause the WordPress site to issue authenticated POST requests to arbitrary Mailgun API endpoints using the site’s configured Mailgun API key. This can be abused to create inbound email-forwarding routes and alter Mailgun-related configuration in ways that expose sensitive mail flows and enable follow-on compromise of the WordPress environment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to act against the victim organization’s Mailgun account through the vulnerable WordPress plugin, using the site’s own API credentials. Reported impact includes creation of inbound email-forwarding routes capable of intercepting password reset messages, which can then be used to reset administrator credentials and take over WordPress administrator accounts. Because the issue enables authenticated requests to arbitrary Mailgun API endpoints, it can also affect confidentiality and integrity of Mailgun-managed messaging configuration and may introduce broader operational disruption depending on what API actions are performed.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or deactivate the Mailgun for WordPress plugin until an updated version can be deployed. Restrict exposure to the vulnerable request path or AJAX/admin handler where operationally feasible, particularly from untrusted networks. Monitor for unexpected changes to Mailgun routes, mailing lists, and forwarding behavior, and investigate anomalous password reset activity or unexplained administrator account changes. Rotating the Mailgun API key as soon as practical reduces the value of any previously abused integration.
Patch, then assume compromise.
Upgrade Mailgun for WordPress to version 2.2.1 or later, where the issue is fixed. After patching, rotate the Mailgun API key configured for the site because the vulnerable application may have exposed the ability to perform unauthorized API actions. Review Mailgun routes and mailing-list configuration for unauthorized changes, especially inbound forwarding rules that could have been added to capture sensitive email traffic. If compromise is suspected, reset affected WordPress administrator credentials and audit administrative actions and mail-handling configuration for persistence or follow-on abuse.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.