WordPress - Mailgun For WordPress - CRITICAL - CVE-2026-78003. The Mailgun for WordPress plugin is vulnerable to Server-Side Request Forgery (SSRF) due to inadequate input validation within the add_list() function. This function handles user-controlled array keys derived from $_POST['addresses'] and processes them through sanitize_text_field(). As a result, unauthenticated attackers can exploit this vulnerability to send authenticated POST requests to any Mailgun API endpoint using the site’s API key. This may include creating inbound email-forwarding routes that can jeopardize account security by intercepting critical emails, such as password reset requests, potentially leading to unauthorized access and takeover of administrator accounts.