Server-Side Request Forgery in Mailgun for WordPress Plugin

CVE-2026-78003

What is CVE-2026-78003?

The Mailgun for WordPress plugin is vulnerable to Server-Side Request Forgery (SSRF) due to inadequate input validation within the add_list() function. This function handles user-controlled array keys derived from $_POST['addresses'] and processes them through sanitize_text_field(). As a result, unauthenticated attackers can exploit this vulnerability to send authenticated POST requests to any Mailgun API endpoint using the site’s API key. This may include creating inbound email-forwarding routes that can jeopardize account security by intercepting critical emails, such as password reset requests, potentially leading to unauthorized access and takeover of administrator accounts.

References