FGR Mail SMTP WP Registry grade B-. Medium-severity findings · 4 findingsWP RegistryMedium-severity findings · 4 findingsOpen the reportB-

Medium-severity findings.

Audited release

1.12.6

Findings

4

Worst severity

medium

Content hash

8c79e3163fc4f0bcd99fc921… Copy

Findings

• medium SMTP settings and test-mail handlers lack capability checks (nonce-only)

  missing_capability

  FGR_SMTP_Settings::handle_save() and handle_test_mail() run on admin_init and verify check_admin_referer but never call current_user_can(). WordPress nonces only prove the request shares the current user session; they are not authorization. Any principal that can present a valid nonce for these actions can overwrite SMTP/MS365 credentials (host, username, password, tenant, app id, client secret) or send test mail, enabling outbound mail diversion. Compare with DB SMTP Mailer in this batch, which correctly gates with manage_options before saving.

  includes/class-fgr-smtp-settings.php:27-84

  Recommendation

  At the start of handle_save() and handle_test_mail(), require current_user_can( 'manage_options' ) (and is_super_admin()/manage_network on multisite if that is the intended scope) before processing POST data.

• medium Unsigned remote write of must-use PHP plugin from GitHub

  insecure_config

  fgr_mu_sync() downloads fgr-plugin-overview.php from GitHub releases/raw and file_put_contents() it into WPMU_PLUGIN_DIR on plugin activation and when related FGR plugins update. There is no content hash, signature, or allowlist beyond a version header regex. Compromise of the GitHub repo or a MITM on the HTTPS path yields persistent PHP execution as a must-use plugin on every site that runs the sync.

  fgr-mail-smtp.php:395-445

  Recommendation

  Pin expected SHA-256 of the MU plugin per release, verify before write, or ship the MU file inside this plugin and copy locally. Avoid silently installing executable PHP from the network.

• medium SMTP settings and test-mail handlers lack capability checks (nonce-only)

  missing_capability

  FGR_SMTP_Settings::handle_save() and handle_test_mail() run on admin_init and verify check_admin_referer but never call current_user_can(). Nonces are not authorization. Any principal that can present a valid nonce for these actions can overwrite SMTP/MS365 credentials (host, username, password, tenant, app id, client secret) or send test mail, enabling outbound mail diversion. Render_page correctly checks manage_options, but the POST handlers do not. Compare with DB SMTP Mailer in this batch, which gates manage_options before saving.

  includes/class-fgr-smtp-settings.php:27-131

  Recommendation

  At the start of handle_save() and handle_test_mail(), require current_user_can( 'manage_options' ) (and appropriate network caps on multisite) before processing POST data.

• medium Unsigned remote write of must-use PHP plugin from GitHub

  insecure_config

  fgr_mu_sync() downloads fgr-plugin-overview.php from GitHub releases/raw and file_put_contents() it into WPMU_PLUGIN_DIR on plugin activation and when related FGR plugins update. There is no content hash, signature, or integrity allowlist beyond a Version header regex. Compromise of the GitHub repo or a MITM/CDN path that serves altered PHP yields persistent code execution as a must-use plugin on every request.

  fgr-mail-smtp.php:395-445

  Recommendation

  Pin expected SHA-256 of the MU plugin per release and verify before write, or ship the MU plugin inside this package instead of fetching remote PHP at runtime.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.