WP Manifestindependent plugin directory
manifest / email / wordpress-plugin-smtp-relay

SMTP Relay WP RegistryLow-severity findings · 1 findingOpen the reportA-

📤 Configure a SMTP relay for outgoing WordPress emails.

by jakobword · github.com/jaylinski/wordpress-plugin-smtp-relay

★ 3stars
v1.0.0latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jaylinski/wordpress-plugin-smtp-relay/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/jaylinski/wordpress-plugin-smtp-relay ↗

SMTP Relay WordPress Plugin

This plugin lets you configure a SMTP relay for outgoing emails.

This is especially useful if the mail() function is not configured on your system but a SMTP relay like Postfix is available.

This plugin currently only works with unauthenticated (internal) SMTP relays!

Screenshots

Admin Interface

Releases

3 releases.

Tag
Published
v1.0.0 latest
Dec 23, 2021 4 years ago
v0.1.1
Aug 8, 2018 8 years ago
v0.1.0
Jul 31, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

SMTP Relay 1.0.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.0
Findings
1
Worst severity
low
Content hash
8246d15de78616eca9bdf3a8…

Findings

  • low Test-mail AJAX action lacks a capability check

    missing_capability

    SMTPRelayAdmin::action_test is registered on wp_ajax_smtp-relay_test and verifies only the 'smtp-relay' nonce before calling wp_mail() to an arbitrary validated address. There is no current_user_can() check. The nonce is generated only on the manage_options settings page, so exploitation would require a leaked admin nonce, and the email body is fixed ('SMTP Relay Test'). This is defence-in-depth only.

    includes/class.smtp-relay.admin.php:222-235

    Recommendation

    Add `if ( ! current_user_can( 'manage_options' ) ) wp_die( '', 403 );` before sending.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →