A critical SSRF vulnerability in the Mailgun for WordPress plugin permits unauthenticated attackers to manipulate the site API and perform account takeovers.

The plugin contains an SSRF vulnerability in the add_list function due to insufficient input validation. An unauthenticated attacker can send crafted POST requests to the Mailgun API, facilitating the creation of email-forwarding routes that intercept sensitive communications.

This flaw poses a severe threat to site security, as it allows attackers to intercept password reset emails and perform full administrator account takeovers. Given the CVSS score of 9.8, the potential for total loss of site control and subsequent data theft makes this a high-priority incident for all WordPress administrators.

Immediate Action: Update the Mailgun for WordPress plugin to version 2.2.1 or later immediately.

Proactive Monitoring: Review WordPress audit logs for unexpected account modifications, password reset requests, or changes to email-forwarding configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious POST requests containing path traversal patterns directed toward plugin-specific endpoints.

Public Exploit Available: Unknown (no confirmed public exploit in available data)

This vulnerability is highly critical due to the ease with which an attacker can escalate to full site administration. All users of the Mailgun for WordPress plugin must update to version 2.2.1 without delay to prevent potential account takeover and unauthorized email interception.