SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security 13 Nov: TI Wishlist, User Verification, Defender

WordPress plugin security 13 Nov: TI Wishlist, User Verification, Defender

If your WordPress site runs TI WooCommerce Wishlist, User Verification or Defender Security, update them today. Patchstack listed these on 12 November 2026. The wishlist and User Verification holes need no login and Patchstack expects them to be attacked. Four smaller plugins have holes just as serious, and seven more have fixes for lesser problems.

Which plugins need attention first?

Patchstack gives every item below its high priority label, meaning it expects mass attacks on sites that have not updated. None of them needs a login.

  • Ultimate Addons for Elementor Forms below 1.0.8: anyone can upload a harmful file through the forms add-on, which can lead to a full site takeover. Top score of 10. Fixed in 1.0.8.
  • File Upload to Order below 1.1.4: a file handling hole open to anyone, also scored 10. Patchstack's feed calls it file deletion and the advisory page files it under file upload. This plugin is not on WordPress.org, so get 1.1.4 from wherever you bought or downloaded it.
  • Descope below 1.2.0: an outsider could get into other people's accounts without their password. Fixed in 1.2.0.
  • TI WooCommerce Wishlist below 2.0.7: someone with no login could read or change the site's database, which holds customer accounts and orders. 2.0.7 is an old release, so most shops are already past it. A second, low priority hole lets outsiders delete items from other people's wishlists, fixed in 2.13.0. The current version, 2.14.2, covers both.
  • Clockinator Lite below 1.1.0: the same kind of database hole. A low priority hole in the same version let outsiders change staff leave records. Both are fixed in 1.1.0.
  • User Verification (by PickPlugins) below 2.0.49: an outsider could log in as another user, including an admin. Fixed in 2.0.49. The current version is 2.0.50.

What about Defender Security and the others?

Defender Security runs on about 80,000 sites. Patchstack rates its two holes low priority and unlikely to be used, but it is a security plugin, so a weak spot matters more than usual. Version 6.4.1 fixes both:

  • Below 6.4.1, a logged in user could get past two-step login.
  • From 4.9.0 to 6.4.0, an outsider could fake the visitor IP address the plugin sees, which can weaken its IP blocking and lockouts.

Mine CloudVod below 2.6.6 is rated medium priority: an outsider could see the keys the plugin uses for cloud video storage. Update, then change those keys at your storage provider, since they may already have been read.

Plugin Affected Update to Problem
WP Remote Users Sync below 2.3.0 2.3.0 A user with a custom role can become an admin
Order Tracking below 3.6.2 3.6.2 Outsiders can see other customers' order history
Abilities Bridge below 1.4.2 1.4.2 An admin tricked into opening a bad link could create an admin account for someone else
ContentPen below 1.1.1 1.1.1 Harmful script saved by an outsider, runs when an admin opens it
JetEngine 3.9.1 and older 3.9.1.1 Script injection by Contributor accounts
Quiz And Survey Master 11.3.0 and older 11.3.1 Outsiders can add text to pages; Contributors can reach things they should not

Patchstack rates all six low priority. JetEngine is a paid Crocoblock plugin, so its update comes through your Crocoblock licence, not WordPress.org.

What to do

  1. Take a backup of the files and database before you start.
  2. Go to Plugins, then Installed Plugins, and look for every name above.
  3. Update the six high priority plugins first. Then Defender Security and Mine CloudVod, then the table.
  4. For File Upload to Order and JetEngine, download the update from the seller and upload it, or use their own update button.
  5. After each update, load the home page, the shop or wishlist page and any form that uses the plugin.
  6. Check Users for admin accounts you do not recognise, and remove them.
  7. If you use Mine CloudVod, create new storage keys and delete the old ones.
  8. If you do not need a plugin, delete it instead of leaving it switched off.

Forward this post to whoever manages your site if that is not you.

How SyncTech can help

Our managed WordPress updates and security checks take care of updates like these and test the site after each one.

Source and credit

We are sharing this news from Patchstack and the WordPress.org plugin directory. This summary is written by Synctech in our own words.

Retrieved 13 Nov 2026. WordPress, WooCommerce, Elementor, Defender, JetEngine and the other plugin names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.