CVE-2026-78003: CWE-918 Server-Side Request Forgery (SSRF) in mailgun Mailgun for WordPress

CVE-2026-78003 is a critical SSRF vulnerability in the Mailgun for WordPress plugin (<=2.2.0). The vulnerability arises from inadequate sanitization of user-controlled array keys in the add_list() function, which processes $_POST['addresses'] after passing them through sanitize_text_field(). This allows unauthenticated attackers to perform authenticated POST requests to Mailgun API endpoints using the site's API key, including creating inbound email-forwarding routes. Such actions can intercept sensitive emails like password resets, potentially leading to administrator account compromise.

An attacker can exploit this SSRF vulnerability without authentication to make authenticated API calls on behalf of the WordPress site using its Mailgun API key. This can result in creation of inbound email-forwarding routes that intercept sensitive emails, including password reset emails, facilitating administrator account takeover. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin and consider disabling it to prevent exploitation. Monitor for vendor updates and apply patches promptly once released.