Blog Mailgun 2.2.2 patches a pre-auth SSRF on 80,000 WordPress sites
Mailgun 2.2.2 patches a pre-auth SSRF on 80,000 WordPress sites
Mailgun for WordPress 2.2.2 fixes an unauthenticated SSRF triggered by a path traversal in form handlers. Four more plugin CVEs published the same day include three that let anyone sign in as admin, and one PHP object injection in WS Form.
Five critical CVEs were published against WordPress plugins on the same day, and four of them let an unauthenticated visitor act as an admin one way or another. The biggest by install base is mailgun, the Mailgun for WordPress plugin, which shipped 2.2.2 for an SSRF that any anonymous request can trigger. The plugin runs on 80,000 sites.
The other four are the kind of story that stops being a coincidence once you see them together. Three login plugins ship logic that trusts the caller and issues a session anyway. A fourth deserializes form data straight from a POST field. None of them require the attacker to be logged in first.
mailgun 2.2.2
The add_list() function reads array keys from $_POST['addresses'], runs them through sanitize_text_field(), and treats the result as safe. It is not safe. An attacker can shape those keys to include path segments and steer the outbound request wherever they want it to go. The request goes out with the site’s own credentials, so it can reach anything the site itself can reach.
An SSRF like this is a common way to reach internal services that never expected a request from the internet, and to read responses the attacker was never meant to see. The plugin is listed on the directory at version 2.2.2, and the fix is to update.
- Affected: versions up to and including 2.2.0
- CVE: CVE-2026-78003, CVSS 9.8
- Installed on 80,000 sites
- Patched in 2.2.2
- Update, then review any outbound requests the site made from vulnerable versions
ws-form 1.12.6
The WS Form LITE plugin unserializes values that arrive with a form submission. Deserializing input you did not write is the way PHP object injection bugs happen. NVD notes that no public POP chain is known in the plugin itself, but that does not close the door. A POP chain can come from another plugin on the same site, or from a WordPress release that adds one later.
- Affected: versions up to and including 1.10.80
- CVE: CVE-2026-4703, CVSS 9.8
- Installed on ~10,000 sites
- Patched in 1.12.6
- Update, and check any other plugins on the site that receive raw form data
firebase-authentication 1.7.1
The Firebase Authentication plugin takes a token, reads the email address inside it, and looks up the matching WordPress account. It skips the step where it checks that the email address in the token was verified. A visitor who can present a token with any email address gets a session for the account tied to that address. If the site has an admin whose email is known, that is an admin session.
- CVE: CVE-2026-76793
- Installed on ~500 sites
- Patched in 1.7.1
- Update, then rotate credentials for every admin account and review recent logins
soclever up to 1.2.0, unpatched
The Social Login & Sharing plugin from SoClever exposes a login handler that skips every check a login handler is meant to do. There is no authentication, no authorisation, no nonce. Any anonymous request to that handler returns a valid session. NVD adds that by default the session is for the site’s original administrator account.
- Affected: versions through 1.2.0
- CVE: CVE-2026-77001
- No install count is published for this plugin
- No patched version is published; if the plugin is in use, replace or remove it
smilepass up to 1.0.2, unpatched
SmilePass Selfie Login accepts a request that names an account and issues a session for it, with no server-side check that the caller is really that person. As with SoClever, any registered account is reachable this way, admins included.
- Affected: versions through 1.0.2
- CVE: CVE-2026-77002
- No install count is published for this plugin
- No patched version is published; if the plugin is in use, replace or remove it
Bugs like these all end at the same place. An attacker becomes an admin, and the next thing they do is install a file that runs when a visitor loads the site. A scanner that reads the site’s files and flags the ones that do not belong there is how the second stage gets caught.
Tags: #wordpress , #plugin , #cve , #exploit