Is Easy Wp Smtp safe?

Plugin details

• Slug: easy-wp-smtp
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.4.4 [CVE-2020-35234, Easy WP SMTP <= 1.4.2 - Sensitive Information Disclosure, Easy WP SMTP &lt; 1.4.3 - Debug Log Disclosure]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.2.5 [CVE-2017-7723, Easy WP Smtp &lt; 1.2.5 - XSS, Easy WP SMTP <= 1.2.4 - Cross-Site Scripting]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.4.3 [WordPress Easy WP SMTP plugin <= 1.4.2 - Unauthenticated Admin Password Reset]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.3.9.1 [WordPress Easy WP SMTP plugin <= 1.3.9 - Unauthenticated arbitrary "wp_options" import vulnerability]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.0 [CVE-2022-3334, WordPress Easy WP SMTP plugin <= 1.4.9 - Auth. PHP Objection Injection vulnerability, Easy WP SMTP <= 1.4.9 - Authenticated (Administrator+) PHP Object Injection, Easy WP SMTP &lt; 1.5.0 - Admin+ PHP Objection Injection]

+ 10 more known vulnerabilities

• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [CVE-2022-45833, Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Directory Traversal, Easy WP SMTP &lt; 1.5.2 - Admin+ Arbitrary File Access]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [CVE-2022-45829, Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion, Easy WP SMTP &lt; 1.5.2 - Admin+ Arbitrary File Deletion]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [CVE-2022-42699, Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Remote Code Execution, Easy WP SMTP &lt; 1.5.2 - Admin+ RCE]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.5.2 [WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.3.9.1 [Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.3.9.1 [wpscan.com]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 1.3.9.1 [CVE-2019-25141]
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more [easy-wp-smtp] < 2.3.1 [CVE-2024-3073, Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin — 4000000+ active installs — max PHP 8.4
• MC4WP: Mailchimp for WordPress — 1000000+ active installs — max PHP 8.4
• Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App — 300000+ active installs — max PHP 8.4
• WP Mail Logging — 300000+ active installs
• Mailchimp for WooCommerce — 200000+ active installs — max PHP 8.4