Plugin inspection:

New User Approve

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.


This recommendation applies to version 1.5.7 of this plugin, but the most recent version is 2.6. These findings may no longer be correct.


  • In includes/user-list.php on line 193 a $_GET parameter is passed through esc_attr() and assigned to a variable. On line 202 it is put unescaped into an SQL query.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

The plugin potentially contains an SQL injection vulnerability. It looks like it may be exploitable by non-admins if an admin is convinced to follow a link.

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements

Read more about our failure criteria.