Before I start I want to do a spoiler: most of this is post is a security\u00a0disclosure\u00a0for vulnerabilities I found in two WordPress plugins.<\/p>\n
One of the most requested feature at the time I started to maintain Post SMTP<\/a>\u00a0is full email body preview in the email log.<\/p>\n Post SMTP only show the raw email, and when you think of this allowing full preview can cause a big headache in the security aspect. I’m not a shame to say I always love to see other developers code, you can always learn and find new ways to get the result you wanted.<\/p>\n I downloaded the plugin and Contact Form 7 for the check.<\/p>\n My goal here is the message field and how is escaped\u00a0to achieve the best preview result. Everything sent, no errors, I browsed to WP Mail Log menu and pressed the View button and boom:<\/p>\n The result in the security world is called:\u00a0Stored XSS Attack\u00a0<\/a>, you are welcome to read the full attack description in the link to\u00a0owasp.org.<\/p>\n Check the code shows two problems.<\/p>\n Checking the Inside the file The conclusion\u00a0here that every email field that gets external input is vulnerable\u00a0to cross-site scripting.<\/strong><\/p>\n OK, let’s leave WP Mail Logging<\/strong> on the side, I downloaded Email Log<\/a>\u00a0– 10,000 active installs.<\/p>\n Same test, SAME RESULTS –\u00a0Stored XSS.<\/a><\/p>\n I work full time, I didn’t have too much time to monitor the developers\u00a0fix on this, so I contact WordPress plugin team. If you want mail logging solution I want to highly recommend the plugin Email Log by Sudar<\/strong>. Sudar answer by contact and updated me after the fix super fast<\/strong>.<\/p>\n While the WP Mail Logging<\/strong> developer\u00a0didn’t even reply back<\/strong> and notice he fixed it after a day (maybe more).<\/p>\n ** Edit:<\/strong>\u00a0Christian Z\u00f6ller\u00a0answered me this in my facebook post<\/a>:<\/p>\n You should have respected my wish to use one of the listed support channels instead of my private website. (I don’t run a mailserver but catch all mails with my plugin). Stored XSS is possible due the nature of my plugin: log mail 1:1. XSS was an security issue for sure – message vuln. fixed 4h after suspension (but delayed due review process) of the plugin. Field vuln. fixed 2h after finding your mail unexpected in my WP backend. Thanks for your cooperation. https:\/\/goo.gl\/n173ub<\/a><\/p>\n<\/blockquote>\n The short link is for a book cover that I can only guess deal with the thankless of open source software – My answer:<\/strong><\/p>\n My responsibility is to notify you as soon as possible and for me, the contact form on your website for reporting \u00abnot a bug issue\u00bb was the best notify option. Even if for your opinion I did something wrong, for the security of your 20,000 users you should respond me back in an adult way back by email, and not \u00abpunish\u00bb me for not listening to your message.<\/p>\n<\/blockquote>\n I’m not a security expert, the XSS attack is one of the attacks I know and can easily test.<\/p>\n If you have one of the plugins installed you SHOULD update immediately\u00a0to the latest version.<\/p>\n \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" Before I start I want to do a spoiler: most of this is post is a security\u00a0disclosure\u00a0for vulnerabilities I found in two WordPress plugins. One of the most requested feature at the time I started to maintain Post SMTP\u00a0is full email body preview in the email log. Post SMTP only […]<\/p>\n","protected":false},"author":5384,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_uag_custom_page_level_css":"","advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"default","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":"","_llm_markdown_disabled":false,"jetpack_post_was_ever_published":false},"categories":[13],"tags":[],"class_list":["post-203","post","type-post","status-publish","format-standard","hentry","category-security"],"acf":[],"author_meta":{"display_name":"Editorial Team","author_link":"https:\/\/postmansmtp.com\/es\/author\/editorial-team\/"},"featured_img":null,"spectra_custom_meta":{"_elementor_controls_usage":["a:3:{s:11:\"text-editor\";a:3:{s:5:\"count\";i:1;s:15:\"control_percent\";i:0;s:8:\"controls\";a:1:{s:7:\"content\";a:1:{s:14:\"section_editor\";a:1:{s:6:\"editor\";i:1;}}}}s:6:\"column\";a:3:{s:5:\"count\";i:1;s:15:\"control_percent\";i:0;s:8:\"controls\";a:1:{s:5:\"style\";a:1:{s:21:\"eae_animated_gradient\";a:1:{s:19:\"gradient_color_list\";i:1;}}}}s:7:\"section\";a:3:{s:5:\"count\";i:1;s:15:\"control_percent\";i:0;s:8:\"controls\";a:1:{s:5:\"style\";a:1:{s:21:\"eae_animated_gradient\";a:1:{s:19:\"gradient_color_list\";i:1;}}}}}"],"_yoast_wpseo_primary_category":[""],"_yoast_wpseo_content_score":["30"],"_wpac_nonmembers_redirect_to":[""],"_wpac_show_excerpt_in_search":["0"],"_wpac_show_in_search":["0"],"_wpac_members_redirect_to":[""],"_wp_page_template":["default"],"_edit_last":["6277"],"_edit_lock":["1773218708:6407"],"classic-editor-remember":["classic-editor"],"_seopress_robots_primary_cat":["none"],"_seopress_redirections_type":["301"],"_seopress_redirections_logged_status":["both"],"um_content_restriction":["a:8:{s:26:\"_um_custom_access_settings\";b:0;s:14:\"_um_accessible\";i:0;s:28:\"_um_access_hide_from_queries\";b:0;s:19:\"_um_noaccess_action\";i:0;s:30:\"_um_restrict_by_custom_message\";i:0;s:27:\"_um_restrict_custom_message\";s:0:\"\";s:19:\"_um_access_redirect\";i:0;s:23:\"_um_access_redirect_url\";s:0:\"\";}"],"site-sidebar-layout":["default"],"site-content-layout":["default"],"theme-transparent-header-meta":["default"],"stick-header-meta":["default"],"_elementor_edit_mode":["builder"],"_elementor_template_type":["wp-post"],"_elementor_version":["3.21.8"],"_elementor_pro_version":["3.21.3"],"_seopress_analysis_target_kw":[""],"_eael_post_view_count":["2446"],"post_views_count":["297"],"ezd_doc_layout":[""],"ezd_doc_content_type":[""],"ezd_doc_content_type_right":[""],"ezd_doc_content_box_right":[""],"_elementor_page_settings":["a:20:{s:18:\"eael_ext_toc_title\";s:17:\"Table of Contents\";s:22:\"_seopress_titles_title\";s:0:\"\";s:21:\"_seopress_titles_desc\";s:121:\"A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features.\";s:22:\"_seopress_robots_index\";s:0:\"\";s:23:\"_seopress_robots_follow\";s:0:\"\";s:27:\"_seopress_robots_imageindex\";s:0:\"\";s:24:\"_seopress_robots_archive\";s:0:\"\";s:24:\"_seopress_robots_snippet\";s:0:\"\";s:26:\"_seopress_robots_canonical\";s:0:\"\";s:28:\"_seopress_robots_primary_cat\";s:4:\"none\";s:25:\"_seopress_social_fb_title\";s:0:\"\";s:24:\"_seopress_social_fb_desc\";s:121:\"A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features.\";s:23:\"_seopress_social_fb_img\";s:0:\"\";s:30:\"_seopress_social_twitter_title\";s:0:\"\";s:29:\"_seopress_social_twitter_desc\";s:121:\"A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features.\";s:28:\"_seopress_social_twitter_img\";s:0:\"\";s:27:\"_seopress_redirections_type\";i:301;s:28:\"_seopress_redirections_value\";s:0:\"\";s:30:\"_seopress_redirections_enabled\";s:0:\"\";s:28:\"_seopress_analysis_target_kw\";s:0:\"\";}"],"_elementor_data":["[{\"id\":\"61847539\",\"elType\":\"section\",\"settings\":{\"eae_slider_delay\":\"5000\",\"gradient_color_list\":[{\"eae_animated_gradient_color\":\"#00a6d8\",\"_id\":\"acf6bbc\"},{\"eae_animated_gradient_color\":\"#b800c9\",\"_id\":\"15a2e0c\"},{\"eae_animated_gradient_color\":\"#e57600\",\"_id\":\"c5f6d6f\"}]},\"elements\":[{\"id\":\"b258e37\",\"elType\":\"column\",\"settings\":{\"_column_size\":100,\"eae_slider_delay\":\"5000\",\"gradient_color_list\":[{\"eae_animated_gradient_color\":\"#00a6d8\",\"_id\":\"bdab5ac\"},{\"eae_animated_gradient_color\":\"#b800c9\",\"_id\":\"97c9dae\"},{\"eae_animated_gradient_color\":\"#e57600\",\"_id\":\"db259de\"}]},\"elements\":[{\"id\":\"73db8682\",\"elType\":\"widget\",\"settings\":{\"editor\":\" One of the most requested feature at the time I started to maintain Post SMTP<\\\/a>\\u00a0is full email body preview in the email log.<\\\/p> Post SMTP only show the raw email, and when you think of this allowing full preview can cause a big headache in the security aspect. I'm not a shame to say I always love to see other developers code, you can always learn and find new ways to get the result you wanted.<\\\/p> I downloaded the plugin and Contact Form 7 for the check.<\\\/p> My goal here is the message field and how is escaped\\u00a0to achieve the best preview result. Everything sent, no errors, I browsed to WP Mail Log menu and pressed the View button and boom:<\\\/p> The result in the security world is called:\\u00a0Stored XSS Attack\\u00a0<\\\/a>, you are welcome to read the full attack description in the link to\\u00a0owasp.org.<\\\/p> Check the code shows two problems.<\\\/p> Checking the Inside the file The conclusion\\u00a0here that every email field that gets external input is vulnerable\\u00a0to cross-site scripting.<\\\/strong><\\\/p> OK, let's leave WP Mail Logging<\\\/strong> on the side, I downloaded Email Log<\\\/a>\\u00a0- 10,000 active installs.<\\\/p> Same test, SAME RESULTS -\\u00a0Stored XSS.<\\\/a><\\\/p> I work full time, I didn't have too much time to monitor the developers\\u00a0fix on this, so I contact WordPress plugin team. If you want mail logging solution I want to highly recommend the plugin Email Log by Sudar<\\\/strong>. Sudar answer by contact and updated me after the fix super fast<\\\/strong>.<\\\/p> While the WP Mail Logging<\\\/strong> developer\\u00a0didn't even reply back<\\\/strong> and notice he fixed it after a day (maybe more).<\\\/p> ** Edit:<\\\/strong>\\u00a0Christian Z\\u00f6ller\\u00a0answered me this in my facebook post<\\\/a>:<\\\/p> You should have respected my wish to use one of the listed support channels instead of my private website. (I don't run a mailserver but catch all mails with my plugin). Stored XSS is possible due the nature of my plugin: log mail 1:1. XSS was an security issue for sure - message vuln. fixed 4h after suspension (but delayed due review process) of the plugin. Field vuln. fixed 2h after finding your mail unexpected in my WP backend. Thanks for your cooperation. https:\\\/\\\/goo.gl\\\/n173ub<\\\/a><\\\/p><\\\/blockquote> The short link is for a book cover that I can only guess deal with the thankless of open source software - My answer:<\\\/strong><\\\/p> My responsibility is to notify you as soon as possible and for me, the contact form on your website for reporting \\\"not a bug issue\\\" was the best notify option. Even if for your opinion I did something wrong, for the security of your 20,000 users you should respond me back in an adult way back by email, and not \\\"punish\\\" me for not listening to your message.<\\\/p><\\\/blockquote> I'm not a security expert, the XSS attack is one of the attacks I know and can easily test.<\\\/p> If you have one of the plugins installed you SHOULD update immediately\\u00a0to the latest version.<\\\/p> \\u00a0<\\\/p>\"},\"elements\":[],\"widgetType\":\"text-editor\"}],\"isInner\":false}],\"isInner\":false}]"],"_eael_custom_js":[""],"_acf_changed":[""],"_seopress_titles_desc":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"_bbp_topic_count":["0"],"_bbp_reply_count":["0"],"_bbp_total_topic_count":["0"],"_bbp_total_reply_count":["0"],"_bbp_voice_count":["0"],"_bbp_anonymous_reply_count":["0"],"_bbp_topic_count_hidden":["0"],"_bbp_reply_count_hidden":["0"],"_bbp_forum_subforum_count":["0"],"_uag_custom_page_level_css":[""],"advgb_blocks_editor_width":[""],"advgb_blocks_columns_visual_guide":[""],"ast-site-content-layout":["default"],"adv-header-id-meta":[""],"astra-migrate-meta-layouts":["set"],"footnotes":[""],"_seopress_social_fb_desc":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"_seopress_social_twitter_desc":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"rank_math_description":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"rank_math_facebook_description":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"rank_math_twitter_description":["A security update to Post SMTP improves full email body preview in the email log. Learn more about the enhanced features."],"rank_math_twitter_use_facebook":["off"],"rank_math_robots":["a:1:{i:0;s:0:\"\";}"],"_uagb_toc_options":["a:2:{s:17:\"_uagb_toc_version\";s:10:\"1794265188\";s:18:\"_uagb_toc_headings\";a:6:{i:0;a:4:{s:5:\"level\";i:2;s:2:\"id\";s:9:\"first-try\";s:7:\"content\";s:9:\"First Try\";s:5:\"depth\";i:2;}i:1;a:4:{s:5:\"level\";i:3;s:2:\"id\";s:26:\"problem-1-saving-the-input\";s:7:\"content\";s:27:\"Problem 1, saving the input\";s:5:\"depth\";i:3;}i:2;a:4:{s:5:\"level\";i:3;s:2:\"id\";s:25:\"problem-2-print-the-input\";s:7:\"content\";s:26:\"Problem 2, print the input\";s:5:\"depth\";i:3;}i:3;a:4:{s:5:\"level\";i:2;s:2:\"id\";s:10:\"second-try\";s:7:\"content\";s:10:\"Second try\";s:5:\"depth\";i:2;}i:4;a:4:{s:5:\"level\";i:2;s:2:\"id\";s:13:\"what-did-i-do\";s:7:\"content\";s:14:\"What did I do?\";s:5:\"depth\";i:2;}i:5;a:4:{s:5:\"level\";i:2;s:2:\"id\";s:10:\"conclusion\";s:7:\"content\";s:10:\"Conclusion\";s:5:\"depth\";i:2;}}}"],"copied_media_ids":["a:0:{}"],"referenced_media_ids":["a:0:{}"],"_uag_page_assets":["a:9:{s:3:\"css\";s:14094:\"\/* devanagari *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmg1hVFteOcEg.woff2) format('woff2');\n unicode-range: U+0900-097F, U+1CD0-1CF4, U+1CF7-1CF9, U+200C-200D, U+20A8, U+20B9, U+20F0, U+25CC, U+A830-A839, U+A8E0-A8FF, U+11B00-11B0A;\n}\n\/* latin-ext *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmg1hVGdeOcEg.woff2) format('woff2');\n unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n\/* latin *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmg1hVF9eO.woff2) format('woff2');\n unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;\n}\n\/* devanagari *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmy15VFteOcEg.woff2) format('woff2');\n unicode-range: U+0900-097F, U+1CD0-1CF4, U+1CF7-1CF9, U+200C-200D, U+20A8, U+20B9, U+20F0, U+25CC, U+A830-A839, U+A8E0-A8FF, U+11B00-11B0A;\n}\n\/* latin-ext *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmy15VGdeOcEg.woff2) format('woff2');\n unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n\/* latin *\/\n@font-face {\n font-family: 'Poppins';\n font-style: italic;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiDyp8kv8JHgFVrJJLmy15VF9eO.woff2) format('woff2');\n unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;\n}\n\/* devanagari *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLGT9Z11lFc-K.woff2) format('woff2');\n unicode-range: U+0900-097F, U+1CD0-1CF4, U+1CF7-1CF9, U+200C-200D, U+20A8, U+20B9, U+20F0, U+25CC, U+A830-A839, U+A8E0-A8FF, U+11B00-11B0A;\n}\n\/* latin-ext *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLGT9Z1JlFc-K.woff2) format('woff2');\n unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n\/* latin *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 500;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2) format('woff2');\n unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;\n}\n\/* devanagari *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLCz7Z11lFc-K.woff2) format('woff2');\n unicode-range: U+0900-097F, U+1CD0-1CF4, U+1CF7-1CF9, U+200C-200D, U+20A8, U+20B9, U+20F0, U+25CC, U+A830-A839, U+A8E0-A8FF, U+11B00-11B0A;\n}\n\/* latin-ext *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2) format('woff2');\n unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n\/* latin *\/\n@font-face {\n font-family: 'Poppins';\n font-style: normal;\n font-weight: 700;\n font-display: fallback;\n src: url(https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2) format('woff2');\n unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;\n}\n.wp-block-uagb-container.uagb-block-6a49e24e .uagb-container__shape-top svg{width: calc( 100% + 1.3px );}.wp-block-uagb-container.uagb-block-6a49e24e .uagb-container__shape.uagb-container__shape-top .uagb-container__shape-fill{fill: rgba(51,51,51,1);}.wp-block-uagb-container.uagb-block-6a49e24e .uagb-container__shape-bottom svg{width: calc( 100% + 1.3px );}.wp-block-uagb-container.uagb-block-6a49e24e .uagb-container__shape.uagb-container__shape-bottom .uagb-container__shape-fill{fill: rgba(51,51,51,1);}.wp-block-uagb-container.uagb-block-6a49e24e .uagb-container__video-wrap video{opacity: 1;}.wp-block-uagb-container.uagb-is-root-container .uagb-block-6a49e24e{max-width: 100%;width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-6a49e24e > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 1200px);max-width: var(--inner-content-custom-width);width: 100%;flex-direction: column;align-items: center;justify-content: center;flex-wrap: nowrap;row-gap: 20px;column-gap: 20px;}.wp-block-uagb-container.uagb-block-6a49e24e{box-shadow: 0px 0px #00000070 ;padding-top: 10px;padding-bottom: 10px;padding-left: 10px;padding-right: 10px;margin-top: !important;margin-bottom: !important;overflow: visible;order: initial;border-color: inherit;row-gap: 20px;column-gap: 20px;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-default figure img{box-shadow: 0px 0px 0 #00000070;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure figcaption{font-style: normal;align-self: center;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay figure img{box-shadow: 0px 0px 0 #00000070;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image--layout-overlay__color-wrapper{opacity: 0.2;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image--layout-overlay__inner{left: 15px;right: 15px;top: 15px;bottom: 15px;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image--layout-overlay__inner .uagb-image-heading{font-style: normal;color: #fff;opacity: 1;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image--layout-overlay__inner .uagb-image-heading a{color: #fff;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image--layout-overlay__inner .uagb-image-caption{opacity: 0;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay .wp-block-uagb-image__figure:hover .wp-block-uagb-image--layout-overlay__color-wrapper{opacity: 1;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image--layout-overlay__inner .uagb-image-separator{width: 30%;border-top-width: 2px;border-top-color: #fff;opacity: 0;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure img{width: px;height: auto;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure:hover .wp-block-uagb-image--layout-overlay__inner .uagb-image-caption{opacity: 1;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure:hover .wp-block-uagb-image--layout-overlay__inner .uagb-image-separator{opacity: 1;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-default figure:hover img{box-shadow: 0px 0px 0 #00000070;}.uagb-block-c9b79c98.wp-block-uagb-image--layout-overlay figure:hover img{box-shadow: 0px 0px 0 #00000070;}@media only screen and (max-width: 976px) {.wp-block-uagb-container.uagb-is-root-container .uagb-block-6a49e24e{width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-6a49e24e > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 1024px);max-width: var(--inner-content-custom-width);width: 100%;}.wp-block-uagb-container.uagb-block-6a49e24e{padding-top: 10px;padding-bottom: 10px;padding-left: 10px;padding-right: 10px;margin-top: !important;margin-bottom: !important;order: initial;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure img{width: px;height: auto;}}@media only screen and (max-width: 767px) {.wp-block-uagb-container.uagb-is-root-container .uagb-block-6a49e24e{max-width: 100%;width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-6a49e24e > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 767px);max-width: var(--inner-content-custom-width);width: 100%;flex-wrap: wrap;}.wp-block-uagb-container.uagb-block-6a49e24e{padding-top: 10px;padding-bottom: 10px;padding-left: 10px;padding-right: 10px;margin-top: !important;margin-bottom: !important;order: initial;}.uagb-block-c9b79c98.wp-block-uagb-image .wp-block-uagb-image__figure img{width: px;height: auto;}}.wp-block-uagb-container.uagb-block-21a93d71 .uagb-container__shape-top svg{width: calc( 100% + 1.3px );}.wp-block-uagb-container.uagb-block-21a93d71 .uagb-container__shape.uagb-container__shape-top .uagb-container__shape-fill{fill: rgba(51,51,51,1);}.wp-block-uagb-container.uagb-block-21a93d71 .uagb-container__shape-bottom svg{width: calc( 100% + 1.3px );}.wp-block-uagb-container.uagb-block-21a93d71 .uagb-container__shape.uagb-container__shape-bottom .uagb-container__shape-fill{fill: rgba(51,51,51,1);}.wp-block-uagb-container.uagb-block-21a93d71 .uagb-container__video-wrap video{opacity: 1;}.wp-block-uagb-container.uagb-is-root-container .uagb-block-21a93d71{max-width: 100%;width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-21a93d71 > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 1200px);max-width: var(--inner-content-custom-width);width: 100%;flex-direction: column;align-items: center;justify-content: center;flex-wrap: nowrap;row-gap: 25px;column-gap: 25px;}.wp-block-uagb-container.uagb-block-21a93d71{box-shadow: 0px 0px #00000070 ;padding-top: 30px;padding-bottom: 30px;padding-left: 15px;padding-right: 15px;margin-top: 10px !important;margin-bottom: 10px !important;margin-left: 10px;margin-right: 10px;overflow: visible;order: initial;border-top-width: 1px;border-left-width: 1px;border-right-width: 1px;border-bottom-width: 1px;border-top-left-radius: 10px;border-top-right-radius: 10px;border-bottom-left-radius: 10px;border-bottom-right-radius: 10px;border-style: solid;border-color: #e2e2e2;background-color: #fafafa;row-gap: 25px;column-gap: 25px;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading .uagb-heading-text{color: #214a72;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading {text-align: center;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading .uagb-desc-text{color: #737373;margin-bottom: 0px;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading .uagb-highlight{font-style: normal;font-weight: Default;background: #007cba;color: #fff;-webkit-text-fill-color: #fff;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading .uagb-highlight::-moz-selection{color: #fff;background: #007cba;-webkit-text-fill-color: #fff;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b.wp-block-uagb-advanced-heading .uagb-highlight::selection{color: #fff;background: #007cba;-webkit-text-fill-color: #fff;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b .uagb-heading-text{font-family: \"Poppins\";font-weight: 700;font-size: 28px;margin-bottom: 15px;}.wp-block-uagb-advanced-heading.uagb-block-63b4fb3b .uagb-desc-text{font-family: \"Poppins\";font-weight: 500;font-size: 16px;}@media only screen and (max-width: 976px) {.wp-block-uagb-container.uagb-is-root-container .uagb-block-21a93d71{width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-21a93d71 > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 1024px);max-width: var(--inner-content-custom-width);width: 100%;}.wp-block-uagb-container.uagb-block-21a93d71{padding-top: 30px;padding-bottom: 30px;padding-left: 15px;padding-right: 15px;margin-top: 10px !important;margin-bottom: 10px !important;margin-left: 10px;margin-right: 10px;order: initial;border-style: solid;border-color: #e2e2e2;background-color: #fafafa;}}@media only screen and (max-width: 767px) {.wp-block-uagb-container.uagb-is-root-container .uagb-block-21a93d71{max-width: 100%;width: 100%;}.wp-block-uagb-container.uagb-is-root-container.alignfull.uagb-block-21a93d71 > .uagb-container-inner-blocks-wrap{--inner-content-custom-width: min( 100%, 767px);max-width: var(--inner-content-custom-width);width: 100%;flex-wrap: wrap;}.wp-block-uagb-container.uagb-block-21a93d71{padding-top: 30px;padding-bottom: 30px;padding-left: 15px;padding-right: 15px;margin-top: 10px !important;margin-bottom: 10px !important;margin-left: 10px;margin-right: 10px;order: initial;border-style: solid;border-color: #e2e2e2;background-color: #fafafa;}}\";s:2:\"js\";s:0:\"\";s:18:\"current_block_list\";a:7:{i:0;s:14:\"uagb\/container\";i:1;s:10:\"uagb\/image\";i:3;s:21:\"uagb\/advanced-heading\";i:4;s:17:\"gutena\/newsletter\";i:5;s:22:\"gutena\/newsletter-form\";i:6;s:29:\"gutena\/newsletter-input-field\";i:7;s:31:\"gutena\/newsletter-submit-button\";}s:8:\"uag_flag\";b:1;s:11:\"uag_version\";s:10:\"1794265188\";s:6:\"gfonts\";a:1:{s:7:\"Poppins\";a:2:{s:10:\"fontfamily\";s:7:\"Poppins\";s:12:\"fontvariants\";a:2:{i:0;s:3:\"700\";i:1;s:3:\"500\";}}}s:10:\"gfonts_url\";s:105:\"https:\/\/fonts.googleapis.com\/css?family=Poppins:700,500,700italic,500italic&subset=latin&display=fallback\";s:12:\"gfonts_files\";a:1:{s:7:\"poppins\";s:107:\"https:\/\/postmansmtp.com\/wp-content\/uploads\/uag-plugin\/assets\/fonts\/poppins\/pxiByp8kv8JHgFVrLDD4Z1xlFQ.woff2\";}s:14:\"uag_faq_layout\";b:0;}"]},"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"ezd_embed_thumb":false,"ezd_searrch_thumb16x16":false,"ezd_searrch_thumb50x50":false,"1536x1536":false,"2048x2048":false,"gform-image-choice-sm":false,"gform-image-choice-md":false,"gform-image-choice-lg":false},"uagb_author_info":{"display_name":"Editorial Team","author_link":"https:\/\/postmansmtp.com\/es\/author\/editorial-team\/"},"uagb_comment_info":0,"uagb_excerpt":"Before I start I want to do a spoiler: most of this is post is a security\u00a0disclosure\u00a0for vulnerabilities I found in two WordPress plugins. One of the most requested feature at the time I started to maintain Post SMTP\u00a0is full email body preview in the email log. Post SMTP only […]","coauthors":[],"tax_additional":{"categories":{"linked":["Security<\/a>"],"unlinked":["Security<\/span>"]}},"comment_count":"9","relative_dates":{"created":"Publicado 9 a\u00f1os hace","modified":"Actualizado 2 a\u00f1os hace"},"absolute_dates":{"created":"Publicado el noviembre 11, 2017","modified":"Actualizado el octubre 10, 2024"},"absolute_dates_time":{"created":"Publicado el noviembre 11, 2017 8:52 pm","modified":"Actualizado el octubre 10, 2024 5:50 am"},"featured_img_caption":"","series_order":"","jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/posts\/203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/users\/5384"}],"replies":[{"embeddable":true,"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/comments?post=203"}],"version-history":[{"count":0,"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/posts\/203\/revisions"}],"wp:attachment":[{"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/media?parent=203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/categories?post=203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/postmansmtp.com\/es\/wp-json\/wp\/v2\/tags?post=203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Some of the users point me to existing plugin for reference named: \u00abWP Mail Logging<\/a>\u00ab.
The plugin has 20,000 active installs, well that is good for me.<\/p>\nFirst Try<\/h2>\n
I started with the following\u00a0string injection:<\/p>\n<script>alert(document.cookie);<\/script><\/pre>\n
Problem 1, saving the input<\/h3>\n
WPML_Plugin.php<\/code> code show that input doesn’t pass any sanitize<\/p>\n private function extractMessage( $mail ) {\n if ( isset($mail['message']) ) {\n \/\/ usually the message is stored in the message field\n return $mail['message'];\n } elseif ( isset($mail['html']) ) {\n \/\/ for example Mandrill stores the message in the 'html' field (see gh-22)\n return $mail['html'];\n }\n return \"\";\n }<\/pre>\nProblem 2, print the input<\/h3>\n
WPML_Email_Log_List.php<\/code> the same thing<\/p>\n function column_default( $item, $column_name ) {\n switch ( $column_name ) {\n case 'mail_id':\n case 'timestamp':\n case 'host':\n case 'subject':\n case 'message':\n case 'headers':\n case 'attachments':\n case 'error':\n case 'plugin_version':\n case 'receiver':\n return $item[ $column_name ];\n default:\n \/\/ If we don't know this column maybe a hook does - if no hook extracted data (string) out of the array we can avoid the output of 'Array()' (array).\n return ( is_array( $res = apply_filters( WPML_Plugin::HOOK_LOGGING_COLUMNS_RENDER, $item, $column_name ) ) ) ? '' : $res;\n }\n }\n<\/pre>\nSecond try<\/h2>\n
What did I do?<\/h2>\n
After one shutdown the developers fix the only the message body, I thought they will understand to check everything. so for the second time, I contact them myself, felt bad to cause the second shutdown.<\/p>\n\n
well, it’s an exaggerate hint, no one is forcing to maintain an open source software.<\/p>\n\n
Maybe you should consider making the message more clear about mail server issue.
Side note: tried to contact you in Slack too.<\/p>\nConclusion<\/h2>\n
Some of the users point me to existing plugin for reference named: \\\"WP Mail Logging<\\\/a>\\\".
The plugin has 20,000 active installs, well that is good for me.<\\\/p>First Try<\\\/h2>
I started with the following\\u00a0string injection:<\\\/p><script>alert(document.cookie);<\\\/script><\\\/pre>
Problem 1, saving the input<\\\/h3>
WPML_Plugin.php<\\\/code> code show that input doesn't pass any sanitize<\\\/p> private function extractMessage( $mail ) {\\n if ( isset($mail['message']) ) {\\n \\\/\\\/ usually the message is stored in the message field\\n return $mail['message'];\\n } elseif ( isset($mail['html']) ) {\\n \\\/\\\/ for example Mandrill stores the message in the 'html' field (see gh-22)\\n return $mail['html'];\\n }\\n return \\\"\\\";\\n }<\\\/pre>Problem 2, print the input<\\\/h3>
WPML_Email_Log_List.php<\\\/code> the same thing<\\\/p> function column_default( $item, $column_name ) {\\n switch ( $column_name ) {\\n case 'mail_id':\\n case 'timestamp':\\n case 'host':\\n case 'subject':\\n case 'message':\\n case 'headers':\\n case 'attachments':\\n case 'error':\\n case 'plugin_version':\\n case 'receiver':\\n return $item[ $column_name ];\\n default:\\n \\\/\\\/ If we don't know this column maybe a hook does - if no hook extracted data (string) out of the array we can avoid the output of 'Array()' (array).\\n return ( is_array( $res = apply_filters( WPML_Plugin::HOOK_LOGGING_COLUMNS_RENDER, $item, $column_name ) ) ) ? '' : $res;\\n }\\n }\\n<\\\/pre>Second try<\\\/h2>
What did I do?<\\\/h2>
After one shutdown the developers fix the only the message body, I thought they will understand to check everything. so for the second time, I contact them myself, felt bad to cause the second shutdown.<\\\/p>
well, it's an exaggerate hint, no one is forcing to maintain an open source software.<\\\/p>
Maybe you should consider making the message more clear about mail server issue.
Side note: tried to contact you in Slack too.<\\\/p>Conclusion<\\\/h2>