WP Manifestindependent plugin directory
manifest / email / qbnox-smtp

Qbnox Systems – SMTP Plugin WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Qbnox Systems SMTP plugin with multisite support

★ 0stars
26release downloads
4.5.1latest · 3mo ago

Install

Download qbnox-smtp.zip From the v4.5.0 release on GitHub, Feb 7, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ugenkudupudiqbnox/qbnox-smtp/releases/download/v4.5.0/qbnox-smtp.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

SMTP plugin for WordPress with advanced features including Amazon SES and Brevo webhook support, multisite compatibility, OAuth authentication, and comprehensive email analytics.


Features

  • 🚀 Reliable SMTP: Configure reliable SMTP email delivery for your WordPress site
  • 🌐 Multisite Support: Network-wide configuration for WordPress multisite installations
  • 📊 Email Analytics: Track email delivery, opens, bounces, and engagement metrics
  • 🔔 Webhook Integration: Real-time webhooks for Amazon SES and Brevo (SendinBlue)
  • 🧪 Test Email Diagnostics: Built-in tools to test and troubleshoot email delivery
  • 📝 Email Logging: Comprehensive logging of all outgoing emails for debugging

Requirements

  • WordPress 6.0 or higher
  • PHP 8.0 or higher

Installation

Option 1: Bedrock (Recommended)

For modern WordPress development using Bedrock by Roots:

  1. Add the plugin to your Bedrock project using Composer:
composer require ugenkudupudiqbnox/qbnox-smtp
  1. The plugin will be automatically installed in the web/app/plugins/ directory
  2. Activate the plugin through the WordPress admin panel or via WP-CLI:
wp plugin activate qbnox-smtp

This method is recommended for professional WordPress development as it provides better dependency management and easier updates.

Option 2: Download Latest Release

  1. Download the latest qbnox-smtp.zip file
  2. In your WordPress admin panel, navigate to Plugins > Add New
  3. Click Upload Plugin at the top of the page
  4. Choose the downloaded qbnox-smtp.zip file
  5. Click Install Now
  6. After installation, click Activate Plugin

NOTE: Releases page

Option 3: Manual Installation

  1. Download the latest release qbnox-smtp.zip or from the Releases page
  2. Extract the zip file
  3. Upload the qbnox-smtp folder to /wp-content/plugins/ directory via FTP or file manager
  4. Activate the plugin through the Plugins menu in WordPress

Option 4: Install from Source (Advanced)

If you want to install directly from the GitHub repository:

cd /path/to/wordpress/wp-content/plugins/
git clone https://github.com/ugenkudupudiqbnox/qbnox-smtp.git

Then activate the plugin through the WordPress admin panel.


Configuration

After activation:

  1. Navigate to Settings > Qbnox SMTP in your WordPress admin panel
  2. Configure your SMTP server settings:
    • SMTP Host
    • SMTP Port
    • Encryption (TLS/SSL)
    • Authentication credentials
  3. Configure webhook settings for Amazon SES or Brevo (optional)
  4. Use the Test Email feature to verify your configuration

For WordPress Multisite: Network admins can configure settings network-wide under Network Admin > Settings > Qbnox SMTP.


Documentation

  • DEVELOPERS.md - Development setup, coding standards, and contribution guidelines
  • Releases - Download the latest version

Support

For issues, questions, or feature requests, please open an issue on GitHub.


License

This plugin is licensed under the MIT License.


Version

Current stable version: 4.5.1

Releases

13 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
4.5.1 latest
Jul 23, 2026 3mo ago
tag only
—
Feb 7, 2026 9mo ago
qbnox-smtp.zip
10
Feb 7, 2026 9mo ago
qbnox-smtp.zip
2
Dec 15, 2025 10mo ago
qbnox-smtp.zip
3
Dec 15, 2025 10mo ago
qbnox-smtp.zip
0
Dec 15, 2025 10mo ago
qbnox-smtp.zip
2
Dec 15, 2025 10mo ago
qbnox-smtp.zip
0
Dec 15, 2025 10mo ago
qbnox-smtp.zip
0
Dec 15, 2025 10mo ago
qbnox-smtp.zip
0
Dec 15, 2025 10mo ago
qbnox-smtp.zip
0
Dec 14, 2025 10mo ago
qbnox-smtp.zip
3
Dec 14, 2025 10mo ago
qbnox-smtp.zip
1
Dec 14, 2025 10mo ago
qbnox-smtp.zip
5
B grade

Security

Qbnox Systems – SMTP Plugin 2.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.1.0
Findings
1
Worst severity
medium
Content hash
14476eb07f358ac3424dc38f…

Findings

  • medium Unauthenticated / forgeable delivery webhooks write unbounded rows to the email log

    missing_auth

    The SES webhook accepts any POST body and logs it with no AWS SNS signature verification or topic check. The Brevo webhook verifies hash_hmac('sha256', body, get_site_option('qbnox_brevo_webhook_secret','')). The plugin never sets that secret, so the key is the empty string and anyone can compute a valid x-brevo-signature. Each request inserts a row with an attacker-chosen event name and the full JSON body into {base_prefix}qbnox_email_logs, with no size limit, rate limit or retention. This allows database growth and storage exhaustion, and falsifies the delivery analytics shown to network admins.

    includes/class-webhooks.php:5-21

    Recommendation

    Verify SNS message signatures (SigningCertURL restricted to amazonaws.com, plus TopicArn allowlist). Reject Brevo requests when no secret is configured, and provide a UI to set one. Cap payload size, and add retention and rate limiting to the log table.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.