WP Manifestindependent plugin directory
manifest / email / wordpress-smtp

Free SMTP WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Use PHPMailer with SMTP instead of WordPress defaults wp_mail. You can setup your own SMTP settings on the wp-admin dashboard

by Code IT · github.com/codeit-ninja/wordpress-smtp · website

★ 0stars
125composer installs
v1.1.6latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/codeit-ninja/wordpress-smtp/archive/refs/heads/master.zip

On Packagist as codeit-ninja/wordpress-smtp:

composer require codeit-ninja/wordpress-smtp
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/codeit-ninja/wordpress-smtp ↗
WordPress SMTP 📨     There are many popular plugins already for this, why would I choose this one?   ✅ Does not add bloatware   ✅ Does not spam you to upgrade to a paid version   ✅ Does not add unnecessary CSS or JavaScript   ✅ Non-commercial This is just a plain plugin which tells WordPress to use PHPMailer and SMTP with the provided settings. Installation Download the latest release, or when using composer use Usage Activate the plugin and go to Settings - SMTP, provide the necessary details. Before enabling, send a test mail frist! If the test failed, make sure to resolve the problems before enabling! If you enable with a faulty config, none of your contact forms will work any longer. If nothing wen't wrong and you successfully recieved the test email in your inbox you can check the 'Enable SMTP' checkbox. Bugs / issues Did you ran into a problem thats the fault of this package? Don't hesitate to submit a new issue.

Releases

8 releases.

Tag
Published
v1.1.6 latest
Dec 22, 2023 2 years ago
v1.1.5
Dec 22, 2023 2 years ago
v1.0.5
Aug 7, 2023 3 years ago
v1.04
Aug 7, 2023 3 years ago
v1.0.3
Aug 7, 2023 3 years ago
v1.0.2
Aug 7, 2023 3 years ago
v1.0.1
Aug 7, 2023 3 years ago
v1.0.0
Aug 5, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Free SMTP 1.1.6 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.6
Findings
1
Worst severity
high
Content hash
f29e2cd1986d9843e40239c5…

Findings

  • high SMTP connection test REST lacks capability check

    missing_permission_callback

    register_rest_route for codeit-smtp/v1/test omits permission_callback. test_smtp_connection reads smtp-host/port/username/password from the request body, configures PHPMailer with SMTPDebug, connects to the supplied host, and sends a message to get_option('admin_email'). Low-privileged authenticated users can probe internal hosts (SSRF) and trigger outbound mail.

    includes/Options.php:208-265

    Recommendation

    Add permission_callback requiring manage_options (or activate_plugins to match settings page) and verify X-WP-Nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →