The Mailgun for WordPress plugin suffers from an SSRF flaw caused by inadequate input validation in the add_list() function. The function accepts user-controlled array keys from $_POST['addresses'] and sanitizes them only with sanitize_text_field(), which fails to prevent malicious URL injection. An unauthenticated attacker can therefore construct a POST request that causes the plugin to send authenticated requests to any Mailgun API endpoint using the site's stored API key. This capability enables the attacker to create inbound email-forwarding routes that capture password reset emails, ultimately allowing the attacker to takeover administrator accounts.

Mailgun for WordPress plugin for WordPress, versions up to and including 2.2.0 are affected. Any WordPress installation using these plugin versions with an active Mailgun API key is vulnerable.

The vulnerability carries a CVSS score of 9.8 and is not listed in the CISA KEV catalog. No EPSS score is available, but the lack of an authentication requirement and the use of a privileged API key make exploitation highly feasible. Attackers can trigger the SSRF by sending crafted POST requests to the plugin’s add_list endpoint, potentially leading to complete administrative compromise of the WordPress site.