An urgent advisory for WordPress site administrators on a critical security flaw.
A not insignificant security vulnerability (CVE-2025-59003) has been confirmed in the WP Mailgun SMTP plugin, affecting all versions up to and including v1.0.7. This sensitive data exposure flaw allows an unauthenticated attacker to access private credentials, including your Mailgun API keys and SMTP passwords, through a publicly accessible endpoint.
The vulnerability has been assigned a CVSS score of 5.8, categorising it as a medium-severity risk. However, the potential impact is high. With access to your Mailgun credentials, an attacker could hijack your email infrastructure to send spam, conduct phishing attacks, or distribute malware from your domain. This could lead to your IP and domain being blacklisted, severely impacting your email deliverability and reputation.
The most pressing concern is that the plugin’s developer has not released a patch, and the project appears to be unmaintained. With no official fix on the horizon, immediate action is required to protect your website and email reputation.
What You Need to Do
If your WordPress site uses the WP Mailgun SMTP plugin (v1.0.7 or earlier), you must take the following steps without delay:
- Uninstall the plugin immediately. Deactivating the plugin is not enough; it must be completely removed from your WordPress installation.
- Rotate all exposed credentials. Log in to your Mailgun account and immediately generate new API keys. Similarly, change any SMTP usernames and passwords that were stored or used by the plugin.
- Implement a Web Application Firewall (WAF) rule. If you have a WAF, apply rules to block any unauthenticated requests to the plugin’s files and endpoints. This acts as a vital virtual patch to prevent exploitation.
- Audit for compromise. Check your server and email logs for any suspicious activity. Look for unexpected email sending volumes, failed login attempts, or unusual file modifications.
- Replace the plugin. Once the vulnerable plugin is uninstalled, you should find a reputable, well-maintained alternative to manage your transactional emails. A well-known and secure alternative is the WP Mail SMTP plugin by WPForms.
The security of your email infrastructure is paramount. Given the unauthenticated nature of this vulnerability and the lack of an official patch, the risk of automated attacks is relatively high. By taking these immediate, decisive actions, you can protect your digital assets and maintain the integrity of your email communications.
