{"vulnerability": "CVE-2026-78003", "sightings": [{"uuid": "b852eac0-f837-4111-9eb0-3e51c01c6b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fzkcx23d26e5l", "content": "CVE-2026-78003 - Mailgun for WordPress\nCVE ID : CVE-2026-78003\n \n Published : Aug. 22, 2026, 9:16 a.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up...", "creation_timestamp": "2026-08-22T10:46:57.352958Z"}, {"uuid": "31692ab5-35ca-4ce8-a461-c6751883624c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78003", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117138340214723722", "content": "CRITICAL: Mailgun for WordPress \u22642.2.0 vulnerable to SSRF (CVE-2026-78003). Attackers can exploit input validation in add_list() to hijack admin resets & compromise sites. Update/disable plugin now. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee4923 #OffSeq #WordPress #Infosec #SSRF", "creation_timestamp": "2026-08-22T09:00:25.307366Z"}, {"uuid": "158a5b9d-c099-4a59-b4e3-e47fee13f630", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78003", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtnvxy3zpx2c", "content": "Mailgun for WordPress \u22642.2.0 hit by CRITICAL SSRF (CVE-2026-78003). Unauthenticated attackers can hijack admin resets via site API key. Update/disable plugin ASAP. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee...", "creation_timestamp": "2026-08-22T09:00:26.981179Z"}, {"uuid": "300b885e-03a5-4328-91c2-f3427766279a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtnw5sgefb2m", "content": "\u26a0\ufe0f PATCH NOW\n\nA critical flaw in the Mailgun for WordPress plugin lets a stranger reroute your site's email and reset the admin password. No login needed.\n\nRuns on 80,000+ sites. Affects versions up to 2.2.0.\n\nFix: update to 2.2.1+. (CVE-2026-78003)", "creation_timestamp": "2026-08-22T09:03:42.657911Z"}, {"uuid": "3cbc984a-dd62-404a-8754-0fcc79809fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtnxmy4vyp24", "content": "CVE-2026-78003 - mailgun for wordpress\nThe Mailgun for WordPress plugin (versions up to 2.2.0) lets anyone on the internet send crafted requests that use your site\u2019s Mailgun API key. An attacker could create\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mailgun #CVE #infosec", "creation_timestamp": "2026-08-22T09:30:04.978399Z"}, {"uuid": "dec0a778-3291-4436-ade0-ac5388aeafaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtnxwwqkt42v", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3Mailgun (v2.2.0\u4ee5\u524d) \u3067\u3001\u4e0d\u6b63\u306a\u5165\u529b\u306b\u3088\u308a\u30d1\u30b9\u30fb\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u3092\u4ecb\u3057\u305fSSRF\u8106\u5f31\u6027\u304c\u5b58\u5728\u3002\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u3002\nCVE-2026-78003 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-08-22T09:35:39.170459Z"}, {"uuid": "fe13a0c0-2d7a-49ab-ab81-84018f447a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnzcjyhb324", "content": "\ud83d\udd34 CVE-2026-78003 - Critical (9.8)\n\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78003/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T10:00:03.352546Z"}, {"uuid": "7fd2358c-167f-4654-9fce-b4c3c4084a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtnzpgyur52e", "content": "\ud83d\udea8 CVE-2026-78003 \u2014 CVSS 9.8 CRITICAL\n\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78003\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-22T10:07:19.942998Z"}, {"uuid": "a14c35a8-4ffe-42ac-b1c9-635338307191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://t.me/captainsmok3r_official/469", "content": "CVE-2026-78003:\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.\npoc: https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-78003/poc.py", "creation_timestamp": "2026-08-24T18:00:03.543571Z"}, {"uuid": "efd06d90-fc4b-45ae-a50e-8dbba15cc52c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/469", "content": "CVE-2026-78003:\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.\npoc: https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-78003/poc.py", "creation_timestamp": "2026-08-25T00:00:11.574024Z"}]}