Mailgun WordPress Plugin SSRF Vulnerability

The Mailgun for WordPress plugin is affected. It's vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0.

An unauthenticated attacker can exploit this to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key. This includes creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.