Logo
Retour à la veille

CVE-2026-78003

Publié : 22 août 2026
Modifié : 22 août 2026
Lien officiel NVD
Score CVSS
9.8
CRITICAL

Description détaillée

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L259https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L323https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L331https://plugins.trac.wordpress.org/browser/mailgun/tags/2.1.10/mailgun.php#L557https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L259https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L323https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L331https://plugins.trac.wordpress.org/browser/mailgun/trunk/mailgun.php#L557https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=cve

Dernières Vulnérabilités

CVE-2026-12710

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required.

VOIR DÉTAILS

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

VOIR DÉTAILS

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

VOIR DÉTAILS