Skip to:
Content
Pages
Categories
Search
Top
Bottom

SECURITY ISSUE: participant e-mails visible in BCC


  • pazzaglia
    Participant

    @pazzaglia1

    When I receive a default e-mail alert of a topic or reply from BBPress, if I view the e-mail’s full header the e-mail addresses of all the subscribed users in that topic are visible.

    This is not just the admin alerts, also users are seeing this.

    Please fix!!

Viewing 4 replies - 1 through 4 (of 4 total)

  • pazzaglia
    Participant

    @pazzaglia1

    I meant BBC – too late to edit my subject line, now.


    Robkk
    Moderator

    @robkk

    Maybe not using BCC at all would help, plus this delivers emails through the wp-cron to make sending emails more efficient and make the emails most likely not end up in the spam folder.

    https://wordpress.org/plugins/asyncronous-bbpress-subscriptions/


    pazzaglia
    Participant

    @pazzaglia1

    Rob thanks for the plug-in, which I will use immediately, BUT how is it that it’s not considered a security issue to be giving out “confidential” e-mail addresses Via the BCC field?

    It’s a big breach of privacy.

    This should be fixed at the core! When spammers get wind of this all they need to do is reply or subscribe to a post topic to snag e-mail addresses of participants. They will.

    I don’t want my e-mail address given away and both the BBPress forums and WordPress forums appear NOT to do this while the the default behavior of this application on any other wordpress installation DOES.

    Please consider this carefully for addition into the WordPress core.

    Ciao,

    L


    Robkk
    Moderator

    @robkk

    This could be a server configuration issue. Or maybe it could be an issue using some plugins that modify sending the emails?

    Also that I plugin I recommended you to use, its functionality will probably be in core soon, we will drop BCC entirely.

    If you want, email me some images of the full email headers that show the other recipients emails in it that you are seeing. You can contact me through email by going to my profile on this site and clicking the contact link, and sending the images to my email.

    I also subscribed to this topic so when you reply back I will get an email and I could show you the email headers of this site from gmail. If you are also subscribed then you can just see the difference between the emails being sent from your site and this site.

Viewing 4 replies - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.
Skip to toolbar