Mailgun is emailing customers about a critical flaw in its Mailgun for WordPress plugin. CVE-2026-78003 scores 9.8 out of 10. It let an unauthenticated attacker point a site’s stored Mailgun API key at any Mailgun API endpoint. Long story short: if you run it, make sure it is up to date.
The obvious abuse is an inbound route forwarding the site’s mail to the attacker, password resets included. Get the reset link and the admin account follows.
The plugin has more than 80,000 active installations. Versions up to and including 2.2.0 are affected. The current release is 2.2.3.
How it works
The add_list() function handles list sign-ups. It cleaned visitor-supplied array keys with sanitize_text_field(), which does nothing about path traversal. A crafted key could send the request to any part of the Mailgun API, signed with the site’s key. Wordfence classes it as server-side request forgery. No login or user interaction is needed, so it can be scripted at scale.
Two bugs, one fix
Version 2.2.1 shipped on 9 July and closed two holes. The first, CVE-2026-14834, let anyone add addresses to a site’s lists. It scored 6.5. The SSRF was published on 22 August, six weeks after the fix.
The changelog only mentions preventing “unauthenticated arbitrary list subscription”. Nothing about API keys or account takeover. Anyone reading it in July would have treated the update as spam protection.
On exploitation, sources disagree. VulnCheck reported attacks on 28 August. CISA’s assessment, three days older, says none. emailexpert has not confirmed attacks.
Which key matters
Mailgun’s primary account key has full control across every sending domain on the account. A domain sending key can only send mail for one domain. With a sending key, an attacker could send as the domain but could not create routes.
Sites using the plugin’s list sign-ups need more than sending rights, so they cannot simply switch. The same applies to any ESP plugin on WordPress. Whatever permissions the stored key has, an attacker gets too.
What to do
- Update to 2.2.3 from the GitHub releases page or the WordPress dashboard.
- Check inbound routes in the Mailgun control panel. Delete any you did not create.
- If you find one, treat the site as compromised. Check admin users, reset passwords and review logins.
- Rotate the API key as a precaution. Mailgun’s own guidance is to rotate at least quarterly anyway.
- If the site only sends mail, switch to a domain sending key.
Sites that updated automatically are fine. Sites that read the changelog and decided list spam could wait have some checking to do.
