Solid Mail – SMTP email and logging made by SolidWP Security & Risk Analysis

The wp-smtp plugin, version 2.2.3, presents a mixed security posture. While it demonstrates good practices in several areas, notably with a high percentage of properly escaped outputs and the use of prepared statements for most SQL queries, significant concerns arise from its attack surface. The presence of two AJAX handlers without authentication checks represents a direct pathway for potential unauthorized actions or information disclosure if these handlers are exploitable. The plugin also bundles PHPMailer, which historically has been a target for vulnerabilities, although no specific outdated version is indicated here. The vulnerability history is a notable weakness, with two high-severity CVEs related to Cross-site Scripting and SQL Injection. Although currently unpatched vulnerabilities are reported as zero, the past occurrence of such critical types suggests potential for future issues if not diligently maintained. The lack of critical or high severity taint flows in static analysis is positive, but this must be weighed against the historical vulnerability data and the unprotected entry points.