It also send the test to the removed address.
I’ll do a review and check what is happening… maybe is something related with the cache / transients…
I’ve been doing some testing, changing different times the “Email addresses to notify (separated by commas)” and, after saving it, I click the Test, and it sends it to those email accounts.
Moreover, I did change the new “WPVULNERABILITY_MAIL” From constant, and it changes the “From:” email.
And, I didn’t use the “WPVULNERABILITY_MAIL” “From:” constant, and sent the email from the default Administrator account…
I cannot find anything wrong with that…
Thank you, Javier. I thought that by changing the recipient, I was also changing the sender, but that doesn’t make any sense, and this impression was purely due to a misunderstanding of the process on my part.