Critical flaw in Mailgun for WordPress plugin could let attackers hijack admin accounts

A newly catalogued vulnerability in the Mailgun for WordPress plugin has been given a maximum-severity CVSS score of 9.8, the kind of number that tends to set off alarm bells. The bug, tracked as CVE-2026-78003, affects versions up to and including 2.2.0 of the plugin, and on paper it’s nasty: an unauthenticated attacker could potentially seize control of a WordPress site’s administrator account.

But “critical score” and “your site is definitely doomed” are not the same thing, so let’s separate what’s actually confirmed from what’s still open.

What the bug actually does

According to the CVE description, the flaw sits in the plugin’s add_list() function, which handles data submitted via $_POST['addresses']. The function accepts user-controlled array keys and passes them through WordPress’s sanitize_text_field() — a function designed to clean up text input, not to stop someone smuggling in a crafted path. Because of that gap, an attacker can trick the plugin into making authenticated requests to Mailgun’s API using the site’s own API key.

That matters because Mailgun handles email for the site, including password reset messages. NVD’s write-up says the vulnerability could be used to set up inbound email-forwarding rules, effectively letting an attacker intercept a site’s password reset emails and take over the administrator account from there. It’s classed as a Server-Side Request Forgery (SSRF) issue reached via path traversal, and crucially, it requires no authentication and no user interaction to attempt — which is why the CVSS vector (AV:N/AC:L/PR:N/UI:N) scores so high.

So who is actually at risk

Here’s where the caution kicks in. This only affects websites running the Mailgun for WordPress plugin, and only if it’s configured with a Mailgun API key doing real work in the background. If you don’t run WordPress, or run WordPress without this specific plugin, none of this applies to you.

The CVSS 9.8 rating was assigned by Wordfence, the security firm acting as the CNA (CVE Numbering Authority) for this record, not by NIST’s own analysts — NVD’s page notes its own severity assessment is “not yet provided.” That’s a normal part of the disclosure pipeline, not a red flag in itself, but it’s worth knowing the headline number comes from one vendor’s assessment rather than independent government verification.

More importantly, three things remain genuinely unclear from the published record: whether a patched version of the plugin has actually been released, whether anyone has exploited this in the wild, and how many live installs are actually using the affected versions. The referenced code snippets point to plugin version 2.1.10, while the vulnerability is described as affecting “up to and including 2.2.0,” so it’s not yet obvious from public sources exactly which release, if any, closes the hole.

What to do about it

If you administer a WordPress site and have the Mailgun plugin installed, the sensible move is to check your installed version against whatever the plugin’s official changelog says, update immediately if a fix is available, and rotate your Mailgun API key regardless — that costs nothing and removes any lingering exposure from a leaked key. If you’re not running WordPress with this plugin, there is nothing to do here at all.

This is a legitimately serious flaw for the narrow slice of sites that use this specific tool, but it isn’t a story about WordPress broadly, or about email plugins in general. Fix the one thing that’s actually affected, and move on.