SYNCTECH
Sign in
Plugin and theme security · · by the Synctech team

WordPress plugin security 14 Nov: Optimole, NextGEN Gallery, Imagify

WordPress plugin security 14 Nov: Optimole, NextGEN Gallery, Imagify

If your WordPress site uses Optimole, NextGEN Gallery or Imagify, update them today. Patchstack listed 11 plugin and theme holes on 13 November 2026. Six of them need no login at all, and Patchstack expects five of those to be attacked in bulk. One, in an Elementor forms upload add-on, is already being used in attacks. Every item below has a fixed version.

Which holes are open to anyone?

Patchstack gives the first five its high priority label. It means attackers are expected to scan many sites at once for the old versions.

  • Optimole 4.2.19 and older: an image optimisation and CDN plugin on more than 200,000 sites. An outsider could send data that makes the plugin delete files on the site. Fixed in 4.2.20.
  • Drag and Drop File Upload for Elementor Forms 1.6.2 and older: it adds a file upload box to Elementor forms. An outsider could delete files on the site, which can break it. Patchstack marks this one as known to be exploited, so treat it as the most urgent on the list. Fixed in 1.6.3.
  • AutomatorWP Pro Webhooks 1.4.4 and older: a paid add-on that connects AutomatorWP to other apps through webhooks. An outsider could reset another user's password and take over the account, including an admin. Score 9.8. Fixed in 1.4.5, which comes from the AutomatorWP website, not WordPress.org.
  • Streamit theme below 1.3.10: an outsider could run their own commands on the server. This gets the top score of 10. Fixed in 1.3.10.
  • WPCOM Member below 1.8.3: a member login and registration plugin. An outsider could log in as another user without the password. Fixed in 1.8.3.
  • Spectra 2.20.5 and older: the Gutenberg blocks plugin, on more than one million sites. An outsider could see some information that should stay private. Patchstack rates this low priority. Fixed in 2.20.6.

Which holes need a logged in user?

These are rated low priority because the attacker needs an account on the site first. They still matter if your site lets staff, writers or customers log in.

Plugin or theme Affected Update to Who can use it Problem
NextGEN Gallery 4.5.5 and older 4.5.6 A user with a custom role Delete files on the site
Imagify 2.3.4 and older 2.3.5 Subscriber Reach plugin actions meant for admins
Widget Options 4.2.6.1 and older 4.2.7 Contributor Run their own code on the server
WP Go Maps 10.1.10 and older 10.1.11 Contributor Save harmful script that runs in a browser
Flatsome theme 3.20.12 and older 3.20.13 Contributor Save harmful script that runs in a browser

NextGEN Gallery runs on more than 300,000 sites and Imagify on more than 900,000, so many sites will see these updates. Flatsome is not in the WordPress.org directory, so its update comes from where you bought it, with your theme licence, not the normal WordPress.org update.

What to do

  1. Take a backup of the files and database before you start.
  2. Go to Plugins, then Installed Plugins, and look for every name above. Check Appearance, then Themes, for Streamit and Flatsome.
  3. Update Drag and Drop File Upload for Elementor Forms first, then Optimole, AutomatorWP Pro Webhooks, Streamit and WPCOM Member. After that, do Spectra and the table.
  4. For AutomatorWP Pro Webhooks, Streamit and Flatsome, download the new version from the seller and upload it, or use the seller's own update button with your licence key.
  5. After each update, open the home page, any form with file upload, your galleries and your maps to check they still work.
  6. Check Users for admin accounts you do not recognise, and remove them. If you use AutomatorWP or WPCOM Member, ask your admins to change their passwords.
  7. If a plugin is switched off and you do not need it, delete it. A switched off plugin still leaves its files on the site.

Forward this post to whoever looks after your site if that is not you.

How SyncTech can help

If you would rather not track these lists every week, our WordPress care and update service applies updates like these, keeps a backup first and tests the site after each one.

Source and credit

We are sharing this news from Patchstack and the WordPress.org plugin directory. This summary is written by Synctech in our own words.

Retrieved 14 Nov 2026. WordPress, Elementor, Optimole, NextGEN Gallery, Imagify, Spectra, Flatsome and the other plugin and theme names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.

Related announcements

Questions? Open a ticket or WhatsApp +6016-7618518.