CVE-2026-78003 is a critical SSRF vulnerability in the Mailgun for WordPress plugin (up to version 2.2.0). The vulnerability arises from insufficient validation of user-controlled array keys in the add_list() function, which processes $_POST['addresses'] after sanitize_text_field(). This flaw enables unauthenticated attackers to leverage the site's Mailgun API key to perform authenticated POST requests to any Mailgun API endpoint. Attackers can create inbound email-forwarding routes, allowing interception of password reset emails and leading to administrator account compromise.

An attacker can exploit this SSRF vulnerability to perform authenticated actions on the Mailgun API using the WordPress site's API key without authentication. This includes creating email-forwarding routes that intercept password reset emails, enabling administrator account takeover. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable add_list() functionality and monitor for suspicious POST requests to mitigate exploitation risk.