SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin holes: payment plugins and GoSMTP

WordPress plugin holes: payment plugins and GoSMTP

Over 20 WordPress plugins made security holes public between 21 and 28 October 2026. The ones that matter most for online shops are payment plugins that could let an outsider mark an order as paid, or change and cancel orders, without paying. Three plugins have been closed on WordPress.org with no fixed version. Compare the lists below with your site and update today.

Online shops: payment and checkout plugins

If your WooCommerce shop uses one of these, update it, then compare recent paid orders with your payment provider's own dashboard before you ship.

Plugin Problem Safe version
PayPlug for WooCommerce (Official) Outsiders could see, change, cancel or delete orders 3.1.1
Sadad QA Payment Orders could be marked paid when no secret key was set 1.29
UniPAY Payment Gateway for WooCommerce Fake payment notices accepted 2.4
Casso Flow Fake payment confirmations accepted 4.2.0
Checkout Files Upload for WooCommerce Anyone could upload any file type at checkout 2.4.0
Customer Email Verification for WooCommerce Email check could be skipped 2.8.3
Menu Cart for WooCommerce Scripts could be planted through cart data 3.2.1
Welcart e-Commerce Database and redirect holes 2.12.6

Checkout Files Upload 2.4.0 changes one setting. A blank "accepted file types" box used to allow every file type. Now it allows only the normal WordPress types, so if your customers upload design files, add those types to the box.

Closed plugins with no fix

WordPress.org has closed these. No safe version is listed, so remove them and use another plugin:

  • BitPay Gateway for WooCommerce (closed 15 October). The hole lets someone skip the payment.
  • Bot for Telegram on WooCommerce (closed 23 October). Someone could log in as another user.
  • SSL Wireless SMS Notification (closed 23 October). The same kind of login bypass.
  • Social Web Suite (closed 28 September). A database hole open to anyone.

Other popular plugins to update

  • Essential Addons for Elementor 6.7.3 to 6.8.6: new users could skip the admin approval step at registration. Update to 6.8.7 or newer (6.8.8 is out).
  • GoSMTP below 1.2.5: a user with plugin access could gain more rights. Update to 1.2.5.
  • CMB2 up to 2.13.4, Prime Slider up to 4.7.2, Postie up to 1.9.87 and MxChat up to 3.2.25: a visitor with no login could plant a script that runs when someone opens the page. Fixed in 2.13.5, 4.7.3, 1.9.88 and 3.2.26.
  • Popup by Supsystic below 2.0.2: two holes, one open to visitors. Update to 2.0.2.
  • Media Library Assistant below 3.42: an admin could be tricked into deleting media files. Update to 3.42 or newer.
  • VikRentCar up to 1.4.8: a forged request could run code on the site. Update to 1.4.9 or newer.
  • IvyForms up to 1.5.1: file uploads through public forms. Update to 1.5.2.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Look for the names above and check the version under each one.
  3. Take a backup, then update one plugin at a time and open your shop and forms after each.
  4. Remove the closed plugins and any plugin you no longer use.
  5. On a shop, check paid orders from the last two weeks against your payment provider.

If a web designer looks after your site, send them this page. Our website maintenance for WooCommerce shops covers these updates for care plan customers, and our guide on what website maintenance includes lists the checks to do each month.

Source and credit

We are sharing this news from the plugin makers on WordPress.org and from Patchstack. This summary is written by Synctech in our own words.

Retrieved 29 October 2026. WordPress, WooCommerce, Elementor and the plugin names above are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.