What the Brevo plugin does on your site
The Brevo plugin connects WordPress to a Brevo account, the French email, SMS and notification marketing platform formerly known as Sendinblue. It only works with a v3 API key, entered under Brevo > Home: your contacts, email templates and statistics stay on Brevo, and the plugin acts as the bridge.
Once connected, it does four things. It builds signup forms (the Forms screen) that you place with a widget or the [sibwp_form] shortcode, with double opt-in, a compliance note, a terms checkbox and a Google or Cloudflare captcha. It can replace the WordPress wp_mail function so every email from the site (password resets, notifications, orders) goes out through the Brevo API. It syncs the WordPress accounts you pick, by role, to a Brevo list. And on request, it turns on Brevo’s tracking script and web push notifications.
The plugin itself is free; you pay for the Brevo account. The free plan needs no credit card and lets you send 300 emails a day. WooCommerce integration (abandoned carts, order sync) comes from a separate plugin, Brevo for WooCommerce.
Which sites the Brevo plugin suits
Brevo makes sense when you want one provider for both your newsletter and your site’s email:
- Business sites and blogs starting a newsletter: form, double opt-in and campaigns sent from Brevo’s editor, with no mail server to run.
- Sites whose emails don’t arrive: WordPress messages go out through the Brevo API instead of the host’s mail function.
- Membership and account-based sites: role-based sync pushes subscribers or members to a list, with attribute mapping (first name, last name, registration date).
It’s the wrong pick if you want your contacts kept in the WordPress database with no outside service: MailPoet stores its subscribers in WordPress. If all you need is a relay for site email, a dedicated plugin like WP Mail SMTP works with several providers, Brevo included.
Brevo plugin strengths and limitations
Strengths
- Newsletter and site email in one place. A single API key covers forms, campaigns and delivery of WordPress messages.
- Full-featured forms at no extra cost. Double opt-in, a compliance note, a terms checkbox, multi-list signup and a Google or Cloudflare captcha are all built in.
- User sync by role. You pick the roles, the target list and how attributes map.
- A free plan to get started. 300 emails a day with no credit card, enough to test and to run a small site.
Limitations
- A tight first paid tier. Starter begins at €7 per month for 5,000 emails a month, but caps you at 500 contacts at that tier.
- Automation and web tracking cost extra. Workflows and visitor behavior tracking are listed from the Standard plan up, as is removing the Brevo logo.
- Failed sends are invisible in WordPress. In the current code, Brevo’s
wp_mailreports “sent” even when the API rejects the message: only Brevo’s logs show the failure. - One relay at a time. Sending through Brevo replaces
wp_mailentirely; if another plugin has already declared it, Brevo shows a warning and doesn’t take over sending.
The settings we recommend for Brevo
These settings exist in the current version of the plugin, under the Brevo menu in the dashboard. Form settings live under Brevo > Forms, by editing each form.
| Setting | Recommended value | Why |
|---|---|---|
| Activate email through Brevo Brevo > Home > Transactional emails | Yes, if no other SMTP plugin is active | WordPress emails go through Brevo; with two relays, one of them gets ignored. |
| Choose your sender Same screen | An address on your domain, set up as a sender in Brevo | An address that matches the site helps keep mail out of spam folders. |
| Enter email to send a test Same screen | Your own address, after every change | A test is the only easy way to see that sending really works. |
| Activate Marketing Automation through Brevo Brevo > Home > Automation | No, unless you use Brevo workflows | The tracking script loads from Brevo’s servers on public pages and follows visitors, so it requires consent. |
| Double Opt-In Brevo > Forms > your form | Yes | Each subscriber confirms their address: a cleaner list and proof of consent. |
| Add Captcha Same screen | Yes, Cloudflare Captcha or Google Captcha | Stops bot signups that bloat the list and trigger pointless confirmation emails. |
| Add compliance note Same screen | Yes | Tells subscribers how their data will be used at the moment you collect it. |
| Roles to sync Brevo > Home > Users Synchronisation | Only roles that agreed to get your emails | Every role is checked by default, administrators included. |
- Send the test email, then check that it shows up in the transactional email logs of your Brevo account.
- Request a password reset from the login page: the email should arrive from the sender you chose.
- Sign up with a test address: the double opt-in confirmation email should arrive, and the contact should join the list only after the click.
- If automation is off, view the source of a page: Brevo’s
sdk-loader.jsscript should not appear.
Brevo plugin security: medium-severity flaws, one with no login needed
The vulnerabilities published for this plugin are rated medium, but the most recent one required no account at all. The cases worth knowing:
- CVE-2025-14799, fixed in 3.3.1: a loose comparison on a REST API route let an anonymous visitor disconnect Brevo, wipe the API key, delete the forms and reset the settings (CVSS 6.5).
- CVE-2024-8477, fixed in 3.1.88: a CSRF attack could disconnect the Brevo account if an administrator clicked a booby-trapped link (CVSS 4.3).
- CVE-2026-15297, fixed in 3.1.78: reflected XSS through a URL parameter, exploitable without an account via a booby-trapped link (CVSS 6.1).
Version 3.3.5 also adds permission checks to several settings routes that author and contributor accounts could reach. Turn on automatic updates for the plugin (see our guide to automatic plugin updates). WP Masquerade Pro replaces the addresses of the /wp-content/plugins/mailin/ folder and the IDs of its scripts, which makes the plugin harder to spot for bots targeting these flaws, without replacing the update.
What WP Masquerade hides for Brevo (Sendinblue)
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Brevo (Sendinblue): without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
ajax_sib_front_object, sibErrMsg - CSS classes
sib-* - files served by the vendor
sibautomation.com
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Brevo plugin FAQ
Is the Brevo plugin free?
Yes, the plugin is free, but it requires a Brevo account. The free plan allows 300 emails a day; the Starter plan begins at €7 per month for 5,000 emails a month.
Can I keep WP Mail SMTP or FluentSMTP alongside Brevo?
Yes, as long as you leave “Activate email through Brevo” set to No: the SMTP plugin then sends the site’s email, and Brevo only handles forms and contacts. Never turn on both relays at once.
Is the Brevo plugin enough for WooCommerce?
No. Abandoned carts and order sync come from the separate Brevo for WooCommerce plugin, also free on wordpress.org.
Are Brevo forms GDPR-compliant?
They give you the tools: double opt-in, a compliance note and a terms checkbox. Consent remains your responsibility, including for the tracking script if you turn it on.