A critical server-side request forgery vulnerability in the Mailgun for WordPress plugin, tracked as CVE-2026-78003 and rated 9.8 out of 10 on the CVSS scale, went public on August 22, 2026. The bug lets an unauthenticated attacker hijack the plugin’s own connection to Mailgun’s API and reroute a site’s password reset emails, which opens a path straight to an administrator takeover. It affects every version up to and including 2.2.0. The plugin runs on more than 80,000 active WordPress sites, and the fix has actually been out since July 9.
How the SSRF Leads to an Admin Takeover
The flaw lives in the plugin’s add_list() function. It takes user-controlled array keys from $_POST['addresses'] and passes them through sanitize_text_field(), which cleans up text formatting but does nothing to check where those values actually point. That gap lets a request reach Mailgun API endpoints the site was never meant to call directly, using the site’s own stored API key to authenticate the call.
In practice, an attacker with no account on the site can use this to create an inbound email-forwarding rule inside the site’s own Mailgun account. Point that rule at an address you control, trigger a password reset for the admin user, and the reset email lands in your inbox instead of theirs. According to the NVD entry for CVE-2026-78003, the CVSS vector requires no privileges and no user interaction, which is what pushes the score to 9.8.
Why the CVE Took Six Weeks to Catch Up to the Patch
Here’s the part worth flagging for anyone who scans changelogs for “security” before deciding whether an update is urgent: this one was already fixed. The plugin’s own changelog on WordPress.org lists version 2.2.1, released July 9, 2026, with the line “Security fix: add nonce verification and server-side list address validation to the add_list AJAX action to prevent unauthenticated arbitrary list subscription,” credited to researcher Pedro Pinho. That is the exact code path CVE-2026-78003 describes. The public CVE record just didn’t catch up until six weeks later, on August 22.
Version 2.2.2 followed on July 17 with an unrelated hardening change, replacing SHA-1 and MD5 hashing with SHA-256 for API request signing. Current installs should be on 2.2.2 or later.
What to Check on Your Site
- Open Plugins in wp-admin and confirm the installed version of Mailgun for WordPress is 2.2.1 or higher. Anything on 2.2.0 or earlier is exposed.
- If you’re behind, update now, then log into your Mailgun account and review the routing and forwarding rules for anything you didn’t set up yourself.
- Rotate the site’s Mailgun API key as a precaution if the site sat on an old version for any length of time. There’s no way to confirm after the fact whether the key was used against the exposed endpoint.
This is the same pattern behind a run of plugin bugs we’ve covered recently, including a User Profile Builder admin takeover bug: a quiet, unglamorous update fixes the actual problem weeks before anyone assigns it a CVE number or a headline. Sites on a real WordPress maintenance and development plan get these updates applied on a schedule instead of waiting for the news cycle to catch up, which is the only real defense against this specific pattern.
