SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security 12 Nov: Forminator, User Registration, GetPaid

WordPress plugin security 12 Nov: Forminator, User Registration, GetPaid

Update Forminator to 1.58.4 and User Registration to 5.3.2 if your WordPress site uses them. Patchstack listed both on 11 November 2026: in each, someone with no login could end up with more rights on the site than they should have. Remove the Security For WooCommerce plugin, which has five holes and no fix. AskAny, Contest Gallery, GetPaid and 10 more also have fixes out.

Which plugins need attention first?

  • AskAny (AI chatbot) below 2.2.0: anyone can upload a file that could be used to take over the site. Patchstack gives it the top score and expects mass attacks. Fixed in 2.2.0.
  • Ultimate Security For WooCommerce, listed on WordPress.org as Security For WooCommerce, 1.0.16 and older: five holes, three of them open to anyone with no login. They could let an outsider become an admin, reset the site's secret login keys (which logs everyone out and can take the site down) or delete comments in bulk. Two more let a logged in customer reset or read two-step login codes. There is no fixed version, and WordPress.org closed the plugin on 13 October 2026 pending a review. Remove it.
  • Contest Gallery below 34.0.3: a user with an Author account can upload a harmful file. Patchstack expects this one in mass attacks too. Fixed in 34.0.3.
  • Forminator below 1.58.4: an outsider could raise their own account rights. Patchstack rates it low priority and unlikely to be used, but Forminator runs on a lot of Malaysian business sites. Yesterday's Forminator item was a different, minor hole with the same fixed version, so if you already have 1.58.4 you are covered for both.
  • User Registration below 5.3.2: a similar rights problem, also rated low priority by Patchstack. Fixed in 5.3.2.
  • NotificationX below 3.3.7: outsiders could see content that is not public and run shortcodes on the site. Fixed in 3.3.7.
  • GetPaid 2.8.62 and older: an outsider could get around a payment check. If you sell or invoice with GetPaid, update and look over recent paid orders. Fixed in 2.8.63.
  • ProfilePress below 4.17.6: an outsider could get past the member directory's role limits and see some user profile data. Fixed in 4.17.6.

Which other plugins have fixes?

Plugin Affected Update to Problem
Smoove abandoned cart trigger for WooCommerce 4.0.0 to 4.3.5 4.3.6 Harmful script saved by an outsider, needs an admin to open it
Element Pack Elementor Addons 10.0.4 and older 10.0.5 Script injection by Contributor accounts
Passster 4.3.21 and older 4.3.22 Script injection by Contributor accounts
Back In Stock Notifier for WooCommerce 7.5.2 and older 7.5.3 Outsiders can add text to content
Advanced Product Fields for WooCommerce 1.6.22 to 1.7.3 1.7.4 Buyers can skip the extra charge on paid options
Hubbub Lite 1.36.3.1 and older 1.36.3.2 Some private data exposed
WPZOOM Social Feed Widget & Block 2.4.1 and older 2.4.2 Some private data exposed

Every fixed version above is already on WordPress.org, and most of them have newer releases since.

What to do

  1. Back up the site and its database first, or ask your host to do it.
  2. In WordPress, open Plugins, then Installed Plugins, and compare each version with the lists above.
  3. If Security For WooCommerce is installed, deactivate and delete it. Turn on two-step login with another plugin you trust, and ask every admin to change their password.
  4. Update AskAny, Contest Gallery, Forminator and User Registration first, then the rest, one at a time. After each, open the home page and send a test through your forms.
  5. In Users, filter by Administrator and remove any account nobody knows.
  6. Shops using GetPaid or Advanced Product Fields: compare recent orders with the payments that really came in.
  7. Repeat on any staging or test copy of the site.

If a web designer looks after your site, forward this post and ask them to confirm when it is done.

How SyncTech can help

Our website maintenance plan with backups and plugin updates handles this work each week and checks the site after every update.

Source and credit

We are sharing this news from Patchstack and the WordPress.org plugin directory. This summary is written by Synctech in our own words.

Retrieved 12 Nov 2026. WordPress, WooCommerce, Forminator, GetPaid, Elementor and the other plugin names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.