SECURITY RISK – Vulnerable Plugin –

Hey @annzo
We tested the documented exploit and it didn’t work. The report was either old or wrong. But to be absolutely sure we released an update today to completely replace function described in the report.
best regards, Hannes

Thx. But also your update is marked as security risk. https://patchstack.com/database/vulnerability/wp-html-mail/wordpress-email-template-designer-wp-html-mail-plugin-3-4-0-cross-site-request-forgery-csrf

Thanks @haet ??

Is it likely that this will get patched? For now I’m using an alternative plugin but would like to go back to your one.

@catchlight

as stated above, the exploit was tested and the function was also replaced.

Best regards
Julian

It’s still being flagged in as vulnerable. Can you reach out to Patchstack or something?
https://patchstack.com/database/vulnerability/wp-html-mail/wordpress-email-template-designer-wp-html-mail-plugin-3-4-0-cross-site-request-forgery-csrf?_a_id=431

Hello @jodzeee,

we will try to contact the operators.

Best regards
Julian