Description

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-22T09:16:53.543Z",
  "pubdate": "2026-08-22T09:16:53.543Z",
  "executiveSummary": "The Mailgun for WordPress plugin is susceptible to a Server-Side Request Forgery vulnerability affecting versions up to and including 2.2.0. This security flaw stems from inadequate input validation and improper handling of user-supplied array keys within the application logic. Unauthenticated threat actors can leverage this deficiency to dispatch unauthorized, authenticated POST requests to arbitrary Mailgun API endpoints by abusing the stored WordPress site API key.\nThe primary risk implication of this vulnerability is the potential for full administrative account takeover. An attacker can exploit the Server-Side Request Forgery vector to programmatically create malicious inbound email-forwarding routes. These interceptors can subsequently capture sensitive correspondence, notably password reset tokens and administrative credentials, thereby compromising the integrity and confidentiality of the entire WordPress installation.\nSuccessful exploitation requires no prior authentication, lowering the barrier to entry for remote attackers interacting with the vulnerable WordPress instance over the network. Remediation relies on updating the affected software to a patched version where input sanitization and parameter validation are properly enforced on the vulnerable function inputs.",
  "technicalDetails": "The vulnerability resides in the add_list() function of the Mailgun for WordPress plugin, which fails to adequately validate and sanitize user-controlled array keys supplied via the $_POST['addresses'] parameter. Although the input values are processed through sanitize_text_field(), the associated array keys remain inadequately constrained, introducing a path traversal vector that facilitates Server-Side Request Forgery.\nThe root cause is rooted in insufficient input validation logic, allowing malicious actors to manipulate array structures and coerce the underlying HTTP request mechanism into interacting with unintended URI paths or Mailgun API endpoints. Because the plugin internally manages and appends the stored Mailgun API key to these outbound requests, any successfully forged request inherits full administrative privileges against the targeted Mailgun API context.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker crafts an HTTP POST request containing maliciously manipulated array keys within the $_POST['addresses'] parameter. Second, the vulnerable add_list() function parses these inputs, bypassing the superficial sanitization checks applied via sanitize_text_field(). Third, the plugin constructs an outbound API request to the Mailgun service using the WordPress site's configured API credentials. Fourth, due to the manipulated keys and path traversal capabilities, the request targets arbitrary Mailgun API endpoints rather than the intended functionality.\nPost-exploitation impact includes the programmatic creation of unauthorized inbound email-forwarding routes. Attackers can configure these routes to quietly intercept critical communications, such as password reset emails destined for site administrators. Upon intercepting these tokens, the attacker can execute a password reset flow, take over the administrator account, and ultimately achieve remote code execution or complete system compromise on the WordPress installation."
}