Mailgun for WordPress

Mailgun for WordPress has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of August 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).

Every one of the 2 issues recorded for Mailgun for WordPress has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Mailgun for WordPress is installed on roughly 80,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Mailgun for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-78003

Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

Read the full analysis

Vulnerability Records

2 records


2026-08-21 00:00	Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys Mailgun for WordPress <= 2.2.0	`CVE-2026-78003`	9.8 Critical	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-07-13 00:00	Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription Mailgun for WordPress <= 2.2.0	`CVE-2026-14834`	5.3 Medium	Pedro Pinho	Yes

Showing 1–2 of 2 reports

Latestv2.2.2

Mailgun for WordPress

Author

Mailgun

3.8(49)

76/100

Last Updated

2026-07-17 (1mo ago)

Active Installs

80,000+

Downloads

2,839,911

Requires WP

5.6+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2012-11-21 (14y ago)

Mailgun is the email automation engine trusted by over 10,000 website and application developers for sending, receiving and tracking emails. By taking advantage of Mailgun’s powerful email APIs, developers can spend more time building awesome websites and less time fighting with email servers. Mailgun supports all of the most popular languages including PHP, Ruby, Python, C# and Java. One particularly useful feature of this plugin is that it provides you with a way to send email when the server you are on does not support SMTP or where outbound SMTP is restricted since the plug-in uses the Mailgun HTTP API for sending email by default. All you need to use the plugin is a Mailgun account. Mailgun has a free account that lets you send up to 200 emails per day, which is great for testing. Paid subscriptions are available for increased limits. The latest version of this plugin now supports regions. Select either U.S./North America or Europe to choose the API endpoint from which you will send email. The current version of this plugin only handles sending emails, tracking and tagging and list subscription.

View on WordPress.org