Overview
A critical Server-Side Request Forgery (SSRF) vulnerability has been disclosed in the Mailgun for WordPress plugin, affecting all versions up to and including 2.2.0. Tracked as CVE-2026-78003 and assigned a CVSS v3.1 score of 9.8, this flaw allows unauthenticated remote attackers to make arbitrary HTTP requests from the WordPress server, potentially exposing internal network resources, cloud metadata endpoints, and sensitive infrastructure.
Technical Details
The vulnerability resides in the plugin's add_list() function, which processes user-supplied array keys from the $_POST['addresses'] superglobal without adequate input validation. The function passes these attacker-controlled keys as part of an HTTP request to the Mailgun API — but due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../) to redirect the outbound request to arbitrary targets.
Attack chain:
- Attacker sends a crafted
POSTrequest to the WordPress site with malicious keys in$_POST['addresses'] - The
add_list()function passes those keys — unsanitized — into the URL construction logic - The server issues an HTTP request to an attacker-chosen destination
- Internal resources (e.g.,
http://169.254.169.254/AWS metadata, internal APIs, private network services) are disclosed to the attacker
Because no authentication is required to reach this code path, the attack surface is maximally exposed on any public-facing WordPress installation running the vulnerable plugin.
CVSS Breakdown
| Metric | Value |
|---|---|
| Score | 9.8 Critical |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Mailgun for WordPress | ≤ 2.2.0 | Pending / update immediately |
Impact
Successful exploitation can lead to:
- Internal network reconnaissance — mapping services on the server's local network that are not otherwise externally accessible
- Cloud metadata exfiltration — on AWS, GCP, Azure, and similar cloud-hosted WordPress sites, SSRF to the metadata endpoint (
169.254.169.254) can leak IAM credentials, instance identity documents, and user-data secrets - Bypassing IP-based access controls — attackers can pivot to internal APIs that trust the server's IP
- Port scanning via timing differences in server responses
On cloud-hosted WordPress environments, a single successful request to the instance metadata service can yield cloud provider credentials, leading to full account takeover.
Remediation
- Update immediately — upgrade the Mailgun for WordPress plugin to any version that addresses CVE-2026-78003. Check the WordPress plugin repository for the latest release.
- Disable the plugin if no patched version is available yet — deactivate it via the WordPress admin dashboard until a fix is published.
- Block outbound SSRF at the network layer — configure your web application firewall (WAF) to block responses from internal IP ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16). - Audit WordPress plugins regularly — use tools like WPScan to check installed plugins against known CVE databases.
- Apply least-privilege IAM policies — limit what cloud credentials attached to your web server can access, reducing the blast radius of a metadata endpoint leak.
Detection
Look for anomalous outbound HTTP requests from your WordPress server — particularly those targeting RFC 1918 private address ranges or the link-local 169.254.169.254 metadata endpoint. Web server access logs, WAF logs, and egress firewall logs are the primary detection surfaces.
A POST request to any endpoint handled by the Mailgun plugin containing unusual characters (.., %2e%2e, @, or internal IPs) in the addresses array should be treated as a potential exploitation attempt.