EUVD-2026-64242
GHSA-jr9c-873v-948h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted unauthenticated POST to add_list endpoint
-
DeliveryPath-traversal in $_POST['addresses'] keys
-
ExploitServer calls Mailgun API with site key
-
ExecutionCreate inbound email-forwarding route
-
PersistTrigger admin password reset, intercept email
-
ImpactReset admin credentials, full site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must have the Mailgun for WordPress plugin (≤ 2.2.0) installed AND configured with a valid Mailgun API key - without a stored key there is nothing for the SSRF to abuse, so this is the key limiting factor. Exploitation reaches the vulnerable add_list() function via user-controlled array keys in $_POST['addresses'], and full administrator takeover additionally depends on WordPress using Mailgun for outbound mail so that password-reset messages traverse the attacker-created inbound route. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, and default plugin behavior is affected once a key is configured. |
| Impact | The signals are broadly consistent and point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) indicates remote, low-complexity, unauthenticated exploitation, matching the description's 'unauthenticated attackers.' The realistic impact - hijacking the site's Mailgun key to reroute password-reset email and seize an admin account - supports high confidentiality and integrity impact; the assigned A:H (availability) is less clearly justified by the described attack, which is takeover- rather than denial-focused. No EPSS score, no CISA KEV entry, and no public POC were provided, so real-world exploitation is not confirmed - this is a high-severity, credible issue rather than an evidenced mass-exploitation event. The one caveat: exploitation is only meaningful when the plugin is actually configured with a valid Mailgun API key, which the CVSS 'no conditions' framing does not capture. |
| Exploit ScenarioDerived | An attacker sends a crafted unauthenticated POST request to the vulnerable endpoint with path-traversal sequences embedded in the $_POST['addresses'] array keys, steering the server's Mailgun API call to the routes-creation endpoint. Using the site's own stored API key, the server creates an inbound forwarding route that copies password-reset emails to the attacker; the attacker then triggers a password reset for the admin account, captures the link, and takes over the site. Given AV:N/AC:L/PR:N, this requires only network access and no authentication or user interaction, though no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 22, 2026
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
No vendor-released patched version is identified in the available data - the description marks 2.2.0 as the highest vulnerable version but does not name a fixed release, so upgrade to the latest available Mailgun for WordPress version and confirm against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=cve) that it post-dates 2.2.0 before relying on it. As compensating controls until a confirmed fix is applied: rotate the Mailgun API key and scope it to least privilege in the Mailgun dashboard to limit what a coerced request can do; audit and delete any unexpected inbound Mailgun routes (especially email-forwarding routes) and enable alerting on route changes; place the WordPress admin-ajax/plugin endpoint that reaches add_list() behind a WAF rule blocking path-traversal sequences in the 'addresses' parameter; and consider temporarily deactivating the plugin if Mailgun integration is non-essential, accepting the trade-off of losing Mailgun-based email delivery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Mailgun for WordPress plugin (cpe:2.3:a:mailgun:mailgun_for_wordpress), which integrates a WordPress site's transactional email with Mailgun's HTTP API. The root cause is CWE-918 (SSRF): the add_list() handler builds a Mailgun API request path from attacker-supplied array keys in $_POST['addresses'] and passes them only through sanitize_text_field(), which strips tags and normalizes whitespace but does NOT neutralize path-traversal sequences or restrict the target endpoint. This turns the plugin into a confused deputy - the server holds a privileged Mailgun API key, and the attacker steers where that key is used. The trac references (mailgun.php lines 259, 323, 331, 557 in trunk and tag 2.1.10) point to the request-construction and sanitization code paths involved.
Know when Mailgun For Wordpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated, low complexity, no UI (AV:N/AC:L/PR:N/UI:N); API-key abuse yields admin takeover so C:H/I:H, but no described availability impact so A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
Articles & Coverage 1
Executive ViewAI
The Mailgun for WordPress plugin (versions ≤2.2.0) contains a critical unauthenticated vulnerability enabling attackers to hijack WordPress administrator accounts and gain complete control of affected websites. Any organization running this plugin faces immediate risk of full site compromise, data breach, and potential reputational damage without remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately uninstall or disable the plugin; (2) if business-critical, deploy a Web Application Firewall rule blocking POST requests containing Mailgun API paths; (3) restrict administrator panel access by IP address; (4) enforce multi-factor authentication on all administrative accounts to prevent account takeover if password-reset emails are intercepted; (5) monitor outbound API requests to Mailgun endpoints for anomalous activity indicating exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB