Why is wp-login trying to send an email?

Question

My host sent me the following message:

Below are the recently upload scripts that contain code to send email. You may wish to inspect them to ensure they are not sending out SPAM.

/home/swthief/public_html/wp-login.php:392: if ( $message && !wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) ) /home/swthief/public_html/wp-login.php:393: wp_die( __('The e-mail could not be sent.') . "
\n" . __('Possible reason: your host may have disabled the mail() function.') ); /home/swthief/public_html/wp-login.php:394:

/home/swthief/public_html/wp-includes/class-smtp.php:612: */ /home/swthief/public_html/wp-includes/class-smtp.php:613: public function mail($from) /home/swthief/public_html/wp-includes/class-smtp.php:614: {

/home/swthief/public_html/wp-includes/pluggable.php:434: /home/swthief/public_html/wp-includes/pluggable.php:435: // Set to use PHP's mail() /home/swthief/public_html/wp-includes/pluggable.php:436:
$phpmailer->IsMail();

/home/swthief/public_html/wp-includes/class-phpmailer.php:172: */ /home/swthief/public_html/wp-includes/class-phpmailer.php:173:
public $Sendmail = '/usr/sbin/sendmail'; /home/swthief/public_html/wp-includes/class-phpmailer.php:174:

/home/swthief/public_html/wp-includes/class-phpmailer.php:175: /** /home/swthief/public_html/wp-includes/class-phpmailer.php:176: * Whether mail() uses a fully sendmail-compatible MTA. /home/swthief/public_html/wp-includes/class-phpmailer.php:177: * One which supports sendmail's "-oi -f" options.

/home/swthief/public_html/wp-includes/class-phpmailer.php:585: /** /home/swthief/public_html/wp-includes/class-phpmailer.php:586: * Call mail() in a safe_mode-aware fashion. /home/swthief/public_html/wp-includes/class-phpmailer.php:587: * Also, unless sendmail_path points to sendmail (or something that

/home/swthief/public_html/wp-includes/class-phpmailer.php:658: /** /home/swthief/public_html/wp-includes/class-phpmailer.php:659: * Send messages using PHP's mail() function. /home/swthief/public_html/wp-includes/class-phpmailer.php:660: * @return void

/home/swthief/public_html/wp-includes/class-phpmailer.php:962: /home/swthief/public_html/wp-includes/class-phpmailer.php:963:
// To capture the complete message when using mail(), create /home/swthief/public_html/wp-includes/class-phpmailer.php:964:
// an extra header list which createHeader() doesn't fold in

/home/swthief/public_html/wp-includes/class-phpmailer.php:1081:
/** /home/swthief/public_html/wp-includes/class-phpmailer.php:1082:
* Send mail using the PHP mail() function. /home/swthief/public_html/wp-includes/class-phpmailer.php:1083: * @param string $header The message headers

/home/swthief/public_html/wp-includes/class-phpmailer.php:1587: /home/swthief/public_html/wp-includes/class-phpmailer.php:1588:
// To be created automatically by mail() /home/swthief/public_html/wp-includes/class-phpmailer.php:1589:
if ($this->Mailer != 'mail') {

/home/swthief/public_html/wp-includes/class-phpmailer.php:1604: /home/swthief/public_html/wp-includes/class-phpmailer.php:1605:
// sendmail and mail() extract Cc from the header before sending /home/swthief/public_html/wp-includes/class-phpmailer.php:1606:
if (count($this->cc) > 0) {

/home/swthief/public_html/wp-includes/class-phpmailer.php:1609: /home/swthief/public_html/wp-includes/class-phpmailer.php:1610:
// sendmail and mail() extract Bcc from the header before sending /home/swthief/public_html/wp-includes/class-phpmailer.php:1611:
if ((($this->Mailer == 'sendmail') || ($this->Mailer == 'mail')) && (count($this->bcc) > 0)) {

/home/swthief/public_html/wp-includes/class-phpmailer.php:1618: /home/swthief/public_html/wp-includes/class-phpmailer.php:1619:
// mail() sets the subject itself /home/swthief/public_html/wp-includes/class-phpmailer.php:1620:
if ($this->Mailer != 'mail') {

I am not a programmer, but it appears that wp-login is trying to send an email. This puzzles me. Is that truly what is going on here? And why is Wordpress trying to send an email?

I have the Jetpack plugin installed (I saw the later the pluggable directory is referenced) so I wondered if someone tried to use the "email share" button on a post and this was the result.

Obviously I want to make sure wordpress is not being hijacked to send spam. I did just reinstall wordpress from scratch yesterday on a new DB, new users, and new passwords.

Any help would be much appreciated. Thank you!

Answer 1

wp-login is the file used to send user passwords e.g.

• new user registrations
• user lost passwords

It might be you're getting a lot of registration spam? Is registration turned off on your install (settings > general)?

Answer 2

This is a lazy low quality list generate by your hosting. It is hard to understand it without more context but basically it is just lists the files in which there is a "mail" string and it has very little to do with the actual place which send mail. This kind of list are rarely useful in practice as they flood you with so much details it becomes hard to spot any evil code if one exists.