https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T23:04:02.838086+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-358618 EUVD-2026-358618 2026-10-09T23:04:02.841656+00:00 EUVD-2026-358618 https://cve.radiocsirt.org/vuln/fkie_cve-2026-78003 fkie_cve-2026-78003 2026-10-09T23:04:02.841690+00:00

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

 https://cve.radiocsirt.org/vuln/ghsa-jr9c-873v-948h GHSA-jr9c-873v-948h 2026-10-09T23:04:02.841725+00:00

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.