SURIQ
If you run the Mailgun for WordPress plugin and have not updated it since June, an unauthenticated attacker has had a route to your admin account for over a month, and the changelog line that quietly carried the fix made it sound like a minor spam bug. Wordfence published CVE-2026-78003 on August 22, rating it 9.8 out of 10. It affects every version up to and including 2.2.0, and the plugin is active on more than 80,000 WordPress sites.
The gap between how the fix was described and what the flaw actually does is the story here. Version 2.2.1 shipped on July 9 with a changelog note about stopping "arbitrary list subscription," which reads like a newsletter nuisance. The CVE record now makes the real stakes plain: the same bug is a server-side request forgery that ends in full administrator takeover.
What the flaw actually does
The plugin talks to Mailgun using the API key you configured, which is stored on the site. The vulnerable code path is an unauthenticated action named add_list. It took attacker-supplied input, the keys of a submitted list of addresses, and used that to build the path of the outgoing Mailgun request without screening it for path traversal. That let a visitor with no account redirect those authenticated API calls to Mailgun endpoints of their choosing. In plain terms, the attacker borrows your site's Mailgun credentials to act as your site. Engineers call this a confused-deputy problem, and it is a classic server-side request forgery pattern, where a server is tricked into making requests an outsider could not make directly.
The damaging move Wordfence describes is creating a mail-forwarding route on the Mailgun account. Once inbound mail is copied to an address the attacker controls, they trigger a WordPress password reset for an administrator, catch the reset link in the forwarded copy, and set a new password. From there they own the site. No login, no phishing, no user interaction.
Affected and fixed versions
| Version | Status |
|---|---|
| 2.2.0 and earlier | Vulnerable to CVE-2026-78003 (critical, 9.8) |
| 2.2.1 (July 9, 2026) | Fixed: the add_list action now checks a nonce and validates addresses on the server |
| 2.2.2 (current) | Fixed, plus unrelated hardening |
Update to 2.2.1 or later. The current release is 2.2.2, which swaps some weak hash functions for SHA-256 on top of the July fix. There is no configuration that makes an older build safe: the vulnerable action does not require authentication, so restricting admin access does nothing to close it.
The compromise hides in Mailgun, not in WordPress
Here is the part that catches teams off guard. Because the attack drives your own Mailgun account, the evidence sits in Mailgun's control plane, not in your WordPress logs. An admin combing through WordPress activity may see nothing beyond a password change. The tell is a route or forwarding rule on your Mailgun account that nobody on your team set up.
So updating the plugin is necessary but not sufficient. If you ran a vulnerable version and the site was reachable from the internet, treat it as potentially touched. Audit the Mailgun account for routes and forwards you do not recognize, rotate the Mailgun API key (the plugin held it, and anyone who exploited this could have used it for anything the key allows), review the WordPress user list for administrators you did not add, and force a password reset across privileged accounts. Account takeover surfaces as anomalous administrator logins and sudden privilege changes, the kind of signal that belongs in your alerting whether or not you run a managed detection service.
WordPress email plumbing keeps being the soft spot
This is not an isolated case. Plugins that sit between WordPress and an email provider hold credentials and touch the password-reset flow, which makes them a high-value target. We recently covered Gravity SMTP leaking live email API keys, along with plugin flaws that end in a rogue administrator or a repeat account takeover. The shape is consistent: the vulnerability is unauthenticated, the payoff is the admin account, and the fix is a version bump most sites apply weeks late.
Update, then check your Mailgun account
- Update the Mailgun for WordPress plugin to 2.2.1 or later (2.2.2 is current).
- Open your Mailgun dashboard and review inbound routes and forwarding rules; delete any you did not create.
- Rotate the Mailgun API key the plugin uses, then update it in the plugin settings.
- Check the WordPress administrator list and remove accounts you cannot account for.
- Force a password reset for all privileged users.
At the time of writing there is no public proof-of-concept exploit and no report of exploitation in the wild. That is the good news and the deadline at once: the details are now public, the affected range is known, and the fix has sat in the plugin repository since July. The window to patch quietly is closing.