cve-2026-78003

{
  "cvss": 9.8,
  "datePublished": "2026-08-22T09:16:53.543",
  "dateUpdated": "2026-10-12T16:10:00.220",
  "description": "The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.",
  "id": "CVE-2026-78003",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Mailgun for WordPress",
            "vendor": "mailgun",
            "versions": [
              {
                "lessThanOrEqual": "2.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover."
      },
      {
        "lang": "es",
        "value": "El plugin Mailgun para WordPress para WordPress es vulnerable a la falsificación de petición del lado del servidor (SSRF) a través de salto de ruta en versiones hasta la 2.2.0 inclusive. Esto se debe a una validación de entrada insuficiente en la función add_list(), que acepta claves de array controladas por el usuario desde parámetro , las pasa a través de sanitize_text_field(). Esto hace posible que atacantes no autenticados realicen peticiones POST autenticadas a cualquier endpoint de la API de Mailgun utilizando la clave API del sitio de WordPress, incluyendo la creación de rutas de reenvío de correo electrónico entrantes que pueden interceptar correos electrónicos de restablecimiento de contraseña, lo que lleva a la toma de control de la cuenta de administrador."
      }
    ],
    "id": "CVE-2026-78003",
    "lastModified": "2026-10-12T16:10:00.220",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-78003",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-25T13:14:07.382843Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-22T09:16:53.543",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L259"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L323"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L331"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L557"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L259"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L323"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L331"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L557"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-918"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "CRITICAL",
  "source": "nvd",
  "title": "The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal..."
}