Plugin inspection:

New User Approve

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

This recommendation applies to version 1.5.7 of this plugin, but the most recent version is 2.5.3. These findings may no longer be correct.

Findings

  • In includes/user-list.php on line 193 a $_GET parameter is passed through esc_attr() and assigned to a variable. On line 202 it is put unescaped into an SQL query.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

The plugin potentially contains an SQL injection vulnerability. It looks like it may be exploitable by non-admins if an admin is convinced to follow a link.

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements

Read more about our failure criteria.