Mailgun WordPress Plugin SSRF via Unvalidated Input

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Mailgun for WordPress plugin versions up to 2.2.0 contain a critical Server-Side Request Forgery (SSRF) vulnerability in the add_list() function that allows unauthenticated attackers to bypass authentication controls and make arbitrary requests to the Mailgun API using the site's stored credentials. By exploiting insufficient input validation on $_POST['addresses'] array keys, attackers can manipulate the plugin into sending authenticated API calls to any Mailgun endpoint, effectively stealing the WordPress site's API key and gaining the ability to modify email configurations, access subscriber data, or launch phishing campaigns. This vulnerability affects any WordPress installation running the vulnerable plugin versions, regardless of WordPress hardening measures, as the flaw exists in the plugin's core request handling logic.

Casky's 331 matched security skills leverage Claude's extended reasoning to detect the attack patterns underlying this SSRF vulnerability by mapping reconnaissance (TA0001) and initial compromise attempts (TA0006) against CWE-918 input validation flaws. Practitioners using Casky would identify suspicious POST requests to the Mailgun plugin's vulnerable endpoint containing malformed 'addresses' parameters, observe outbound authenticated API requests to unexpected Mailgun endpoints originating from the WordPress server, and detect API key exposure in request logs or error messages. The skill set flags the critical gap between client-side and server-side validation, revealing how path traversal and insufficient sanitization in add_list() create a direct bridge from unauthenticated user input to authenticated third-party API abuse—a signature pattern of SSRF exploitation that precedes credential theft and account takeover.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78003.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-78003

Casky has 331 skills that investigate the attack patterns behind CVE-2026-78003. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn