This CVE inverts the traditional SSRF model. The attacker doesn't need to reach an internal service — the WordPress plugin itself holds valid Mailgun API credentials, and the path traversal in add_list() lets an unauthenticated actor invoke any Mailgun API method through the plugin's authenticated context. The server becomes the payload, not the springboard.
The injection vector is the array key in $_POST['addresses'], not the value. sanitize_text_field() operates on array values only — this is a well-documented PHP quirk that consistently produces critical vulnerabilities. A code reviewer seeing that sanitization call would reasonably conclude input validation exists, which creates a dangerous false negative.
The CVSS 9.8 is justified: unauthenticated entry, full credential inheritance, and a direct path to administrator account takeover via password reset interception. But the blast radius extends beyond WordPress. The same API key grants access to the entire Mailgun tenant's routing infrastructure — attackers can set forwarding rules on any domain the account controls, potentiallyrelaying through trusted domains.
Immediate actions: First, verify whether the Mailgun for WordPress plugin is installed and disable it or rotate the API key immediately if suspected. Second, rotate any Mailgun API keys used by WordPress plugins regardless of patch status — patching the code does not close the credential exposure window. Third, audit other WordPress plugins for similar array-key injection patterns where sanitize_text_field() or similar functions process array keys without explicit validation.
Detection is exceptionally difficult. The malicious API call is structurally identical to legitimate Mailgun route management. WordPress does not emit structured telemetry about which plugin functions make outbound HTTP calls, and most organizations lack baselines for what normal Mailgun routing activity looks like for this plugin. Focus on prevention through credential scoping: Mailgun and similar providers should support keys with bounded endpoint permissions, limiting damage if compromise occurs.