https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 01:44:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358618 EUVD-2026-358618 https://cve.radiocsirt.org/vuln/euvd-2026-358618 https://cve.radiocsirt.org/vuln/fkie_cve-2026-78003 <p>The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST[&#39;addresses&#39;], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site&#39;s API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.</p> <p>The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST[&#39;addresses&#39;], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site&#39;s API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-78003 https://cve.radiocsirt.org/vuln/ghsa-jr9c-873v-948h <p>The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST[&#39;addresses&#39;], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site&#39;s API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.</p> <p>The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST[&#39;addresses&#39;], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site&#39;s API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.</p> https://cve.radiocsirt.org/vuln/ghsa-jr9c-873v-948h