Mailgun For Wordpress
Monthly
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.