{"uuid": "a14c35a8-4ffe-42ac-b1c9-635338307191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://t.me/captainsmok3r_official/469", "content": "CVE-2026-78003:\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.\npoc: https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-78003/poc.py", "creation_timestamp": "2026-08-24T18:00:03.543571Z"}