SYNCTECH
Sign in
Plugin and theme security · · updated · by the Synctech team

WordPress plugin holes: YOOtheme, JupiterX, Payex

WordPress plugin holes: YOOtheme, JupiterX, Payex

Ten WordPress plugins and themes made security holes public in the week to 27 October 2026. The worst three, in YOOtheme Pro, JupiterX Core and Qode Membership, can be used by someone who has no login on your site. One Malaysian payment plugin, Payex for WooCommerce, has a hole and no fixed version yet. Check the list below against the plugins on your site and update today.

Serious: update today

YOOtheme Pro 5.0.0 to 5.0.52. A visitor with no login can place a file of their choosing on the server through the theme's image handler and run code from it. YOOtheme fixed it in 5.0.53 on 21 October. The same product is also sold for Joomla sites.

JupiterX Core up to 4.61.0. A login bypass lets an outsider sign in as another user. A second, smaller hole lets a Contributor account plant scripts through the login form widget. Version 4.62.0 fixes both.

Qode Membership up to 2.0.6.2. A typing mistake in the code that checks Facebook logins means anyone can take over an account. Update to 2.0.6.3.

Payex for WooCommerce: no fix yet

Payex Payment Gateway for WooCommerce up to 1.2.10 does not check that a "payment received" message really comes from Payex. The secret it uses for this check is empty unless someone sets it. An outsider can then mark any order as paid without paying. The plugin is now closed on WordPress.org and no fixed version is listed.

If your shop uses it, compare every order marked paid since mid-October with your Payex merchant dashboard before you ship anything. Then ask Payex or your developer how to set the validation secret, or move to another supported payment plugin.

Medium: update this week

  • Advanced Custom Fields: Extended up to 0.9.2.6. An outsider could delete media files, but only on sites with a public form that uses the email attachment option. Fixed in 0.9.2.7.
  • AMP for WP up to 1.1.17. Scripts could be planted without a login. Fixed in 1.1.18.
  • Advanced Views up to 3.9.6, through comments, even unapproved ones. Fixed in 3.9.7.
  • Analytics Insights for Google Analytics up to 6.3.12. Fixed in 6.4.
  • affiliate-toolkit up to 3.9.2, one hole open to anyone and one to Contributor accounts. Fixed in 3.9.3.
  • Ultimate Member up to 2.14.0. Fixed in 2.14.1.

A planted script runs when you or a visitor opens the page, and can be used to steal an admin session.

What to do

  1. Log in to WordPress and open Plugins > Installed Plugins, then Appearance > Themes.
  2. Compare the names and version numbers with the lists above.
  3. Take a backup, then update. YOOtheme Pro and JupiterX update from their own dashboards with your licence key.
  4. On a Payex shop, check the paid orders first, as described above.
  5. Delete plugins and themes you no longer use. Every plugin left installed is one more thing to keep updated.

If a web designer looks after your site, send them this page. Our guide on what website maintenance includes lists the monthly checks, and our WordPress plugin update service can do them for you.

Source and credit

We are sharing this news from the plugin and theme makers, WordPress.org, the US National Vulnerability Database and Patchstack. This summary is written by Synctech in our own words.

Retrieved 28 October 2026. WordPress, WooCommerce, YOOtheme, Jupiter X, Qode, Payex, Advanced Custom Fields, AMP for WP, Advanced Views, Analytics Insights, affiliate-toolkit, Ultimate Member, Google Analytics, Facebook, Joomla and Patchstack are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.