Email suppression stays active when no Apprise endpoint is configured #9

New issue

Closed

opened 2026-10-16 21:07:23 -07:00 by eric · 0 comments

eric commented

2026-10-16 21:07:23 -07:00

Owner

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue.

Problem

The email suppressor is registered whenever the plugin is globally enabled (apprise-notifications.php:185-191). It doesn't check that an Apprise endpoint is configured. If api_url is empty, or set to a URL the client rejects, then:

all mode drops every site email, including password resets;
matching mode drops comment-moderation, new-user and auto-update emails;

and the Apprise notification that was supposed to replace them never goes out either. The admin gets nothing.

Fix

Register the suppressor only when $client->is_configured() is also true.
Optionally, log a warning when suppression is configured but skipped.
Possibly show an admin notice when email suppression is on and no API URL is set.
Test: enabled with an empty api_url means no pre_wp_mail or notify_* filters are added.

A send that fails at runtime (endpoint down) can't be detected before wp_mail runs, so this fix covers the "not configured" case only.

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue. ## Problem The email suppressor is registered whenever the plugin is globally `enabled` (`apprise-notifications.php:185-191`). It doesn't check that an Apprise endpoint is configured. If `api_url` is empty, or set to a URL the client rejects, then: - `all` mode drops **every** site email, including password resets; - `matching` mode drops comment-moderation, new-user and auto-update emails; and the Apprise notification that was supposed to replace them never goes out either. The admin gets nothing. ## Fix - Register the suppressor only when `$client->is_configured()` is also true. - Optionally, log a `warning` when suppression is configured but skipped. - Possibly show an admin notice when email suppression is on and no API URL is set. - Test: `enabled` with an empty `api_url` means no `pre_wp_mail` or `notify_*` filters are added. A send that fails at runtime (endpoint down) can't be detected before `wp_mail` runs, so this fix covers the "not configured" case only.

eric added the

bug

label

2026-10-16 21:07:23 -07:00

eric referenced this issue from a commit

2026-10-16 21:26:30 -07:00

test: add wp-env integration suite

eric referenced this issue from a commit

2026-10-16 22:06:22 -07:00

fix: only suppress emails when an Apprise API URL is set

eric closed this issue

2026-10-16 22:06:22 -07:00