Skip to content

Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256 #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oleksandr-mykhailenko merged 2 commits into from
Jul 17, 2026
Merged

Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256 #224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8e91d7a
Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256
oleksandr-mykhailenko Jul 17, 2026
06d84e0
Bump version to 2.2.2 and update changelog
oleksandr-mykhailenko Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
Changelog
=========

2.2.2 (2026-07-17)
- Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256 for the API request hash, multipart boundary generation, and widget ID generation

2.2.1 (2026-07-09)
- Security fix: add nonce verification and server-side list address validation to the `add_list` AJAX action to prevent unauthenticated arbitrary list subscription (reported by Pedro Pinho)

Expand Down
2 changes: 1 addition & 1 deletion includes/wp-mail-api.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,7 +436,7 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = []) {
$payload = '';

// First, generate a boundary for the multipart message.
$boundary = sha1(uniqid('', true));
$boundary = hash('sha256', uniqid('', true));

// Allow other plugins to apply body changes before creating the payload.
$body = apply_filters('mg_mutate_message_body', $body);
Expand Down
6 changes: 3 additions & 3 deletions mailgun.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: Mailgun
* Plugin URI: http://wordpress.org/extend/plugins/mailgun/
* Description: Mailgun integration for WordPress
* Version: 2.2.1
* Version: 2.2.2
* Requires PHP: 7.4
* Requires at least: 5.6
* Author: Mailgun
Expand Down Expand Up @@ -243,7 +243,7 @@ public function api_call( string $uri, array $params = [], string $method = 'POS
case 'DELETE':
$params['sess'] = '';
$params['time'] = $time;
$params['hash'] = sha1( date( 'U' ) );
$params['hash'] = hash( 'sha256', date( 'U' ) );
break;
}

Expand Down Expand Up @@ -522,7 +522,7 @@ public function list_form( string $list_address, array $args = []): void {
*/
public function build_list_form( array $atts ): string {
if ( isset( $atts['id'] ) && $atts['id'] !== '' ) {
$args['widget_id'] = md5( rand( 10000, 99999 ) . $atts['id'] );
$args['widget_id'] = hash( 'sha256', rand( 10000, 99999 ) . $atts['id'] );

if (isset( $atts['collect_name'] ) ) {
$args['collect_name'] = true;
Expand Down
5 changes: 4 additions & 1 deletion readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Mailgun for WordPress
Contributors: mailgun, sivel, lookahead.io, m35dev, alanfuller
Tags: mailgun, smtp, http, api, mail, email
Tested up to: 7.0
Stable tag: 2.2.1
Stable tag: 2.2.2
Requires PHP: 7.4
License: GPLv2 or later

Expand Down Expand Up @@ -133,6 +133,9 @@ MAILGUN_REPLY_TO_ADDRESS Type: string

== Changelog ==

= 2.2.2 (2026-07-17): =
- Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256 for the API request hash, multipart boundary generation, and widget ID generation

= 2.2.1 (2026-07-09): =
- Security fix: add nonce verification and server-side list address validation to the `add_list` AJAX action to prevent unauthenticated arbitrary list subscription (reported by Pedro Pinho)

Expand Down
5 changes: 4 additions & 1 deletion readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Mailgun for WordPress
Contributors: mailgun, sivel, lookahead.io, m35dev, alanfuller
Tags: mailgun, smtp, http, api, mail, email
Tested up to: 7.0
Stable tag: 2.2.1
Stable tag: 2.2.2
Requires PHP: 7.4
License: GPLv2 or later

Expand Down Expand Up @@ -129,6 +129,9 @@ MAILGUN_TRACK_OPENS Type: string Choices: 'yes' or 'no'

== Changelog ==

= 2.2.2 (2026-07-17): =
- Security fix: replace insecure SHA-1/MD5 hash functions with SHA-256 for the API request hash, multipart boundary generation, and widget ID generation

= 2.2.1 (2026-07-09): =
- Security fix: add nonce verification and server-side list address validation to the `add_list` AJAX action to prevent unauthenticated arbitrary list subscription (reported by Pedro Pinho)

Expand Down
Loading