MailPoet – Newsletters, Email Marketing, and Automation

mailpoet · by mailpoet · wordpress.org ↗ · SVN ↗
Active installs
500k+
Current version
5.24.0
Added
2016-10-28
Last updated
2026-04-28 (4d ago)
First seen by beacon
10d ago
Total downloads
65,141,911

Alerts (0)

No open alerts.

Show 5 resolved alerts
High committer_younger_than_plugin Resolved · benign_company_employee 2026-04-27 10:32:30 (5d ago)
Slugmailpoet
Committer sluglysyjan87
Committer display nameJan Lysý
Committer employer
Committer member since2023-11-24
Committer first commit2024-07-16 13:24:48
Committer commit count30
Plugin listed authormailpoet
Earliest plugin commit2022-01-20 13:52:57
Plugin age at join days907
Committer age at join days235
Active installs500,000
View raw JSON
{
    "slug": "mailpoet",
    "committer_slug": "lysyjan87",
    "committer_display_name": "Jan Lys\u00fd",
    "committer_employer": null,
    "committer_member_since": "2023-11-24",
    "committer_first_commit": "2024-07-16 13:24:48",
    "committer_commit_count": 30,
    "plugin_listed_author": "mailpoet",
    "earliest_plugin_commit": "2022-01-20 13:52:57",
    "plugin_age_at_join_days": 907,
    "committer_age_at_join_days": 235,
    "active_installs": 500000
}
High committer_younger_than_plugin Resolved · benign_company_employee 2026-04-27 10:32:30 (5d ago)
Slugmailpoet
Committer slugseuna8c
Committer display nameSeun
Committer employer
Committer member since2024-10-22
Committer first commit2024-12-10 13:23:00
Committer commit count20
Plugin listed authormailpoet
Earliest plugin commit2022-01-20 13:52:57
Plugin age at join days1,054
Committer age at join days49
Active installs500,000
View raw JSON
{
    "slug": "mailpoet",
    "committer_slug": "seuna8c",
    "committer_display_name": "Seun",
    "committer_employer": null,
    "committer_member_since": "2024-10-22",
    "committer_first_commit": "2024-12-10 13:23:00",
    "committer_commit_count": 20,
    "plugin_listed_author": "mailpoet",
    "earliest_plugin_commit": "2022-01-20 13:52:57",
    "plugin_age_at_join_days": 1054,
    "committer_age_at_join_days": 49,
    "active_installs": 500000
}
High committer_younger_than_plugin Resolved · benign_company_employee 2026-04-27 10:32:30 (5d ago)
Slugmailpoet
Committer slugwxa1
Committer display namewxa1
Committer employer
Committer member since2024-07-15
Committer first commit2024-07-23 16:15:48
Committer commit count8
Plugin listed authormailpoet
Earliest plugin commit2022-01-20 13:52:57
Plugin age at join days915
Committer age at join days8
Active installs500,000
View raw JSON
{
    "slug": "mailpoet",
    "committer_slug": "wxa1",
    "committer_display_name": "wxa1",
    "committer_employer": null,
    "committer_member_since": "2024-07-15",
    "committer_first_commit": "2024-07-23 16:15:48",
    "committer_commit_count": 8,
    "plugin_listed_author": "mailpoet",
    "earliest_plugin_commit": "2022-01-20 13:52:57",
    "plugin_age_at_join_days": 915,
    "committer_age_at_join_days": 8,
    "active_installs": 500000
}
Critical code_pattern Resolved · no_longer_matches 2026-04-24 17:01:47 (7d ago)
Slugmailpoet
Patternunserialize_after_remote_call
Kindbuiltin
Version5.23.2
Hit count2
First hit
File
lib/Doctrine/MetadataCache.php
Line
38
Snippet
L38: return unserialize((string)file_get_contents($this->getFilename($id))); → L38: return unserialize((string)file_get_contents($this->getFilename($id)));
Explanationa remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak.
View raw JSON
{
    "slug": "mailpoet",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "5.23.2",
    "hit_count": 2,
    "first_hit": {
        "file": "lib/Doctrine/MetadataCache.php",
        "line": 38,
        "snippet": "L38: return unserialize((string)file_get_contents($this->getFilename($id)));  \u2192  L38: return unserialize((string)file_get_contents($this->getFilename($id)));"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}
Critical code_scan_delta Resolved · fp_vendored_library_local_cache 2026-04-24 15:51:25 (7d ago)
Slugmailpoet
Previous version5.23.2
Current version5.23.2
New findings
PatternKindFileLineSnippetConfidence
unserialize_after_remote_callbuiltinlib/Doctrine/MetadataCache.php38L38: return unserialize((string)file_get_contents($this->getFilename($id))); → L38: return unserialize((string)file_get_contents($this->getFilename($id)));high
unserialize_after_remote_callbuiltinlib/Doctrine/MetadataCache.php48L38: return unserialize((string)file_get_contents($this->getFilename($id))); → L48: $classMetadata = unserialize((string)file_get_contents($filename));high
New finding count2
View raw JSON
{
    "slug": "mailpoet",
    "previous_version": "5.23.2",
    "current_version": "5.23.2",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "lib/Doctrine/MetadataCache.php",
            "line": 38,
            "snippet": "L38: return unserialize((string)file_get_contents($this->getFilename($id)));  \u2192  L38: return unserialize((string)file_get_contents($this->getFilename($id)));",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "lib/Doctrine/MetadataCache.php",
            "line": 48,
            "snippet": "L38: return unserialize((string)file_get_contents($this->getFilename($id)));  \u2192  L48: $classMetadata = unserialize((string)file_get_contents($filename));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

SVN committers (12)

Accounts with actual commit access to mailpoet on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.

Committer Member since Commits First commit Latest commit
Jan Lysý 2023-11-24 30 2024-07-16 · r3119241 2026-03-03 · r3473730
Rostislav Wolný 2020-02-01 28 2024-08-13 · r3134966 2026-02-03 · r3452849
paveldohnal 2020-08-19 26 2024-08-27 · r3142279 2026-04-07 · r3500751
MailPoet 2014-06-12 21 2022-01-20 · r2660756 2025-02-11 · r3238695
Seun Young account 2024-10-22 20 2024-12-10 · r3205671 2026-03-18 · r3485533
Yuliyan Slavchev 2011-11-14 14 2025-05-27 · r3301538 2026-04-15 · r3506855
Eason 2021-06-10 8 2025-06-25 · r3317302 2026-02-10 · r3457852
wxa1 Young account 2024-07-15 8 2024-07-23 · r3124067 2025-02-18 · r3242639
Jan Jakeš 2018-07-29 4 2024-07-30 · r3128216 2024-09-18 · r3153732
Ján Mikláš 2022-10-10 2 2024-08-06 · r3131658 2026-04-28 · r3517318
Oluwaseun Olorunsola 2021-10-04 2 2024-10-22 · r3173666 2024-10-22 · r3173667
websupporter 2013-04-17 1 2024-12-18 · r3209647 2024-12-18 · r3209647

Readme contributors (3)

Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?

Contributor Member since SVN access Status
MailPoet 2014-06-12 21 commits Active
Automattic 2009-11-05 Active
WooCommerce 2011-11-10 Active

Versions (100 most recent)

Version Released Download
5.24.0 2026-04-28 · 4d ago zip
5.23.2 2026-04-15 · 17d ago zip
5.23.1 2026-04-14 · 18d ago zip
5.23.0 2026-04-07 · 25d ago zip
5.22.4 2026-04-01 · 1mo ago zip
5.22.3 2026-03-31 · 1mo ago zip
5.22.2 2026-03-18 · 1mo ago zip
5.22.1 2026-03-10 · 1mo ago zip
5.22.0 2026-03-03 · 2mo ago zip
5.21.3 2026-02-24 · 2mo ago zip
5.21.2 2026-02-17 · 2mo ago zip
5.21.1 2026-02-11 · 2mo ago zip
5.21.0 2026-02-10 · 2mo ago zip
5.20.0 2026-02-03 · 2mo ago zip
5.19.0 2026-01-27 · 3mo ago zip
5.18.0 2026-01-20 · 3mo ago zip
5.17.6 2026-01-13 · 3mo ago zip
5.17.5 2026-01-07 · 3mo ago zip
5.17.4 2025-12-12 · 4mo ago zip
5.17.3 2025-12-09 · 4mo ago zip
5.17.2 2025-12-02 · 5mo ago zip
5.17.1 2025-11-25 · 5mo ago zip
5.17.0 2025-11-12 · 5mo ago zip
5.16.4 2025-11-04 · 5mo ago zip
5.16.3 2025-10-29 · 6mo ago zip
5.16.2 2025-10-21 · 6mo ago zip
5.16.1 2025-10-15 · 6mo ago zip
5.16.0 2025-10-07 · 6mo ago zip
5.15.1 2025-10-01 · 7mo ago zip
5.15.0 2025-09-23 · 7mo ago zip
5.14.3 2025-09-16 · 7mo ago zip
5.14.2 2025-09-09 · 7mo ago zip
5.14.1 2025-09-02 · 8mo ago zip
5.14.0 2025-08-26 · 8mo ago zip
5.13.2 2025-08-20 · 8mo ago zip
5.13.1 2025-08-20 · 8mo ago zip
5.13.0 2025-08-12 · 8mo ago zip
5.12.13 2025-08-05 · 9mo ago zip
5.12.12 2025-07-22 · 9mo ago zip
5.12.11 2025-07-15 · 9mo ago zip
5.12.10 2025-07-08 · 9mo ago zip
5.12.9 2025-07-01 · 10mo ago zip
5.12.8 2025-06-25 · 10mo ago zip
5.12.7 2025-06-17 · 10mo ago zip
5.12.6 2025-06-10 · 10mo ago zip
5.12.5 2025-06-03 · 11mo ago zip
5.12.4 2025-05-27 · 11mo ago zip
5.12.3 2025-05-20 · 11mo ago zip
5.12.2 2025-05-13 · 11mo ago zip
5.12.1 2025-05-06 · 12mo ago zip
5.12.0 2025-04-30 · 1y ago zip
5.11.0 2025-04-23 · 1y ago zip
5.10.1 2025-04-15 · 1y ago zip
5.10.0 2025-03-18 · 1y ago zip
5.9.0 2025-03-11 · 1y ago zip
5.8.1 2025-03-04 · 1y ago zip
5.8.0 2025-02-25 · 1y ago zip
5.7.1 2025-02-18 · 1y ago zip
5.7.0 2025-02-11 · 1y ago zip
5.6.4 2025-02-04 · 1y ago zip
5.6.3 2025-01-28 · 1y ago zip
5.6.2 2025-01-22 · 1y ago zip
5.6.1 2025-01-14 · 1y ago zip
5.6.0 2025-01-07 · 1y ago zip
5.5.2 2024-12-24 · 1y ago zip
5.5.1 2024-12-18 · 1y ago zip
5.5.0 2024-12-10 · 1y ago zip
5.4.2 2024-12-03 · 1y ago zip
5.4.1 2024-11-26 · 1y ago zip
5.4.0 2024-11-19 · 1y ago zip
5.3.7 2024-11-12 · 1y ago zip
5.3.6 2024-11-05 · 1y ago zip
5.3.5 2024-10-30 · 1y ago zip
5.3.4 2024-10-29 · 1y ago zip
5.3.3 2024-10-22 · 1y ago zip
5.3.2 2024-10-22 · 1y ago zip
5.3.1 2024-10-15 · 1y ago zip
5.3.0 2024-10-03 · 1y ago zip
5.2.3 2024-10-01 · 1y ago zip
5.2.2 2024-09-24 · 1y ago zip
5.2.1 2024-09-18 · 1y ago zip
5.2.0 2024-09-12 · 1y ago zip
5.1.1 2024-09-05 · 1y ago zip
5.1.0 2024-09-03 · 1y ago zip
5.0.2 2024-08-27 · 1y ago zip
5.0.1 2024-08-23 · 1y ago zip
5.0.0 2024-08-21 · 1y ago zip
4.58.2 2024-08-13 · 1y ago zip
4.58.1 2024-08-06 · 1y ago zip
4.58.0 2024-07-30 · 1y ago zip
4.57.0 2024-07-23 · 1y ago zip
4.56.0 2024-07-16 · 1y ago zip
4.55.0 2024-07-09 · 1y ago zip
4.54.0 2024-07-02 · 1y ago zip
4.53.0 2024-06-25 · 1y ago zip
4.52.0 2024-06-18 · 1y ago zip
4.51.2 2024-06-12 · 1y ago zip
4.51.1 2024-06-04 · 1y ago zip
4.51.0 2024-05-28 · 1y ago zip
4.50.1 2024-05-21 · 1y ago zip