Mailgun for WordPress SSRF via Path Traversal Leading to Admin Account Takeover

Technical Analysis

CVE-2026-78003 (CVSS 9.8) stems from the add_list() function accepting user-controlled array keys from $_POST['addresses'] and passing them through sanitize_text_field() without adequate path or key validation, allowing path traversal that redirects requests to arbitrary Mailgun API endpoints. Because these requests are authenticated with the WordPress site's Mailgun API key, an unauthenticated attacker can abuse this to create inbound email-forwarding routes, intercept password-reset emails sent to admin accounts, and achieve full site takeover. The vulnerability requires no authentication and no user interaction, making it trivially exploitable at scale against internet-facing WordPress sites running the plugin. If exploited on infrastructure hosting AI agent orchestration layers, RAG pipelines, or WordPress-based content sources that agents ingest or manage, the stolen Mailgun API key and resulting admin access could allow attackers to inject malicious content, exfiltrate credentials/secrets stored in the CMS, or pivot to any connected agent tooling that trusts the compromised WordPress instance as a data source or automation endpoint.

Affected Systems

WordPress sites running the Mailgun for WordPress plugin, versions up to and including 2.2.0

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous POST requests to wp-admin/admin-ajax.php or plugin endpoints containing malformed/array-based 'addresses' parameters, and unexpected Mailgun inbound routes/forwarding rules not created by legitimate administrators.

Remediation Steps

1. 1

   Update the plugin

   Upgrade Mailgun for WordPress to the latest patched version beyond 2.2.0 as soon as it is available from the vendor.

2. 2

   Rotate Mailgun API keys

   Immediately rotate any Mailgun API keys used by affected WordPress sites and audit Mailgun account activity for unauthorized routes or list changes.

3. 3

   Audit email forwarding rules

   Review Mailgun account for unexpected inbound routes or forwarding rules that could intercept password reset or administrative emails, and remove any unauthorized entries.

4. 4

   Restrict plugin exposure

   If a patch is unavailable, disable or remove the plugin, or use a WAF rule to block malformed POST requests to the vulnerable add_list() endpoint.

5. 5

   Enable MFA for admin accounts

   Require multi-factor authentication for all WordPress administrator accounts to reduce impact of password-reset interception.

6. 6

   Monitor for anomalous authentication events

   Watch for unusual admin logins or password reset requests following suspected exploitation attempts.