JamesKoussertari

I had a suspicion it might be malicious but was hoping it wasn’t.

Turns out the hacker had gained access via an old admin account and added WP Code Lite plugin to hide a malicious script.

The script hijacked the genuine card form and added a duplicate form which steals card details.

I’d urge anyone using these types of plugins to check all their snippets and add 2FA on all admin accounts to prevent unauthorised access.

Are there any security measures Payment Plugins can put in place to prevent such a situation for others in future? If it would benefit Payment Plugins to see the malicious code, I’m happy to share it.

Thanks

Hi,

We’ve tried deactivating plugins and it didn’t help.

We’ve also tried rolling back the plugin, CF7 and WordPress to older versions which hasn’t helped either.

The wrong redirects still happen even when we don’t add any redirect settings to a form. So your plugin is redirecting every form regardless of whether an action is added.

When disabling your plugin, the forms no longer redirect, which is expected. Therefore there are no other redirects overriding your plugin.

Could your recent update to make the plugin compatible with WordPress 6.7 have corrupted the database or something similar?

Do you have any ideas how we can debug this further?

Thanks

@dhplugins I am also getting this problem due to the recent update. Deactivating the plugin indeed fixes it.

Hi Mia,

This seems to have done the trick!

Thank you ??

This worked! Thank you ??

Any update on this?

It would be great to get this functionality working by using the settings within the plugin.

Leaving the admin bar visible for subscribers seems like a bit of security concern and also confuses users.

Thanks

I never heard back from anyone on this but someone on your end did something that worked when I gave them admin logins.

No idea how they solved problem 1, but they did. Maybe they tweaked something in the plugin code. Hopefully this sticks whenever a new version is released.

For problem 2, I think they just enabled guest posting in the form settings which somehow fixed it. It doesn’t make sense why that fixes it though. I feel like there are a few settings in this plugin that don’t clearly explain what they do well enough.

Anyway, thanks for fixing.

Hi, any update on this?

Sorry to be pushy but I’m close to launching my site and it’s critical this works or I need to find another solution.

I want to buy your pro plugin but the slow support and multiple bugs with the free version are not filling me with confidence if I am being honest.

I’m really counting on this plugin! ??

Thanks

Hi, just wanted to let you know that unfortunately this code breaks the media upload field on frontend forms. Potentially breaks other fields too but only noticed it on media fields.

Hi, any update on this please?

I am really keen to purchase your pro plugin but I feel uneasy about doing so when there are features like this not working correctly.

My business model relies on this functionality, so if it’s not solved soon I may have to look elsewhere for another solution.

Thanks

Thanks, that did the trick. Will the fix be implemented in the next version?

I have contacted you via your website as instructed and provided a screen recording of the two problems. I look forward to hearing from you. Thanks

Thanks Maybellyne, this worked perfectly!

Hi Pepe,

Thanks for getting back to me. I have now solved this. I think it was this filter which I have now removed:

add_filter( 'woocommerce_defer_transactional_emails', '__return_true' );

I’m assuming this was preventing Stripe from obtaining the order object.

I also changed a few functions which were using the old method of getting the product id:

$product->id;

to

$product->get_id();

So it could have been either of these, or a combination of both that fixed it.

Thanks

UPDATE: I tried the Yoast test plugin one more time to optimise the SEO data whilst on 20.7, and this time it completed successfully. I updated to 20.11 and now all is working well. Thanks