EUVD-2026-64242
GHSA-jr9c-873v-948h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated, low complexity, no UI (AV:N/AC:L/PR:N/UI:N); API-key abuse yields admin takeover so C:H/I:H, but no described availability impact so A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
Articles & Coverage 1
AnalysisAI
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must have the Mailgun for WordPress plugin (≤ 2.2.0) installed AND configured with a valid Mailgun API key - without a stored key there is nothing for the SSRF to abuse, so this is the key limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are broadly consistent and point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted unauthenticated POST request to the vulnerable endpoint with path-traversal sequences embedded in the $_POST['addresses'] array keys, steering the server's Mailgun API call to the routes-creation endpoint. Using the site's own stored API key, the server creates an inbound forwarding route that copies password-reset emails to the attacker; the attacker then triggers a password reset for the admin account, captures the link, and takes over the site. … |
| Remediation | No vendor-released patched version is identified in the available data - the description marks 2.2.0 as the highest vulnerable version but does not name a fixed release, so upgrade to the latest available Mailgun for WordPress version and confirm against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=cve) that it post-dates 2.2.0 before relying on it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable and uninstall the Mailgun for WordPress plugin from all instances; review administrative account login logs for unauthorized access and reset compromised credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mailgun For Wordpress
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today