FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Security & Risk Analysis

The plugin 'fluent-smtp' v2.2.95 exhibits a mixed security posture. While it demonstrates good practices in using prepared statements for a high percentage of SQL queries and properly escaping a significant portion of its output, there are notable areas of concern. The presence of an unprotected AJAX handler is a significant risk, providing an easily accessible entry point for attackers. Furthermore, the use of the `unserialize` function, even without evident taint flows in this specific static analysis, historically represents a critical vulnerability class if not handled with extreme care regarding input sources. The plugin's vulnerability history is a substantial red flag, with a notable number of past CVEs across all severity levels, including a past critical vulnerability. This pattern suggests a recurring tendency to introduce security flaws, and the fact that the last reported vulnerability was relatively recent in 2025 indicates ongoing security challenges. Despite its strengths in data handling, the unprotected entry points and historical vulnerability trends necessitate caution.