WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions
WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of October 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 2 issues recorded for WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-25171WP SmartPay <= 2.7.13 - Authenticated (Subscriber+) Account Takeover
Read the full analysisVulnerability Records

WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions
Author
Convers Lab
Need to charge for something on WordPress — a service, a subscription, a donation — but don’t want to set up a whole online store just to do it? WPSmartPay accepts payments, subscriptions, and donations without WooCommerce, cart plugins, or custom code. Create a payment form, connect a gateway, share the link — start getting paid in minutes. Invoice clients, bill recurring subscriptions, or collect one-time and recurring donations. No store to configure, no products to manage — just a form and a gateway. ✅ What’s New in Version 3.4.0 Complete Donation & Fundraising Campaigns — Launch fundraising campaigns with target goals, public campaign pages, and live progress bars. Gutenberg Donation Form Blocks — Build donor checkout forms with preset giving tiers, Give Anonymously toggles, Donor Comments, Tributes (in honor/memory), and Step Breaks. Interactive Donor Wall (Pro) — Celebrate supporters with public donor listings, recent vs top donor sorting, and comment moderation. Recurring Donations & Custom Billing (Pro) — Accept recurring giving on preset subscription tiers or let donors choose their own custom amount and frequency (daily, weekly, monthly, yearly). Dedicated Donors & Donations Directory — Keep donor relationships and gift records organized separately from standard sales and customer lists. Accept Payments Your Way Connect the gateway that fits your business and start accepting payments immediately: PayPal Standard — Free, trusted, works out of the box Manual / Free Payment — For $0 or pay-later flows Stripe (Pro — most popular) — Cards, Apple Pay, Google Pay, Link, 135+ currencies Authorize.net (Pro) — Industry-standard gateway for US and Canadian businesses Mollie (Pro) — Ideal for European businesses; iDEAL, SEPA, and more Paddle (Pro) — Global merchant of record; handles VAT and sales tax automatically Razorpay (Pro) — Best for India-based businesses; cards, UPI, netbanking toyyibPay (Pro) — Malaysian FPX online banking gateway Paytm (Pro) — Popular Indian payment gateway bKash (Pro) — Mobile banking payments in Bangladesh See all gateways and pricing Invoicing Built Into WordPress Stop switching between tools. WPSmartPay lets you create and send professional invoices without leaving the WordPress admin. Generate invoices for one-time or recurring payments Send to customers by email in one click Track status from Draft through Sent, Paid, and Overdue Customize with your logo and business details Learn more about invoicing Subscription and Recurring Payments (Pro) Accept recurring payments and build predictable revenue streams with WPSmartPay Pro. Set up recurring billing on any payment form — weekly, monthly, or yearly Installment plans and fixed-period billing cycles Membership plans with role-based access control Renewal reminder emails sent automatically Supported on Stripe and Paddle gateways Learn more about subscriptions Native Gutenberg Form Builder & Blocks Build payment and donation forms the WordPress way — with native blocks and live previews as you design: Drag-and-drop form fields — Name, email, phone, address, text, textarea, select dropdowns, radio options, and checkboxes Flexible pricing models — Fixed product prices, suggested donation tiers, custom amount inputs, and recurring billing cycles Dedicated donation blocks — Give Anonymously, Donor Comment, Tribute / Dedication, Step Break, Campaign Goal Progress, and Campaign Donors (Pro) Ready-made template library — Pick from curated templates (including the Charity Donation template) or start from a blank canvas Universal embedding — Embed forms anywhere using the SmartPay Form block, the [smartpay_form] shortcode, or a clean popup overlay Checkout experience controls — Stacked or split layouts, and per-form “require login to checkout” settings Complete WordPress Donations and Fundraising Collect one-time and recurring donations, launch fundraising campaigns, and recognize supporters with an interactive donor wall — without bloated eCommerce tools or needing a separate donation plugin. Whether you run a charity, nonprofit organization, community project, church, or personal fundraiser, WPSmartPay turns WordPress into a reliable fundraising and nonprofit payments platform. Native Gutenberg Donation Form Blocks Design donor checkout forms directly in the WordPress block editor with live visual preview: * Preset donation tiers and custom amounts — Offer suggested gift amounts (such as $25, $50, $100, $250) or let supporters type their own custom donation amount. * Custom amount recurring billing (Pro) — Empower donors to select their custom amount and preferred giving frequency (daily, weekly, monthly, or yearly) directly in the Pricing block. * Give Anonymously block — A privacy checkbox allowing donors to give anonymously. Anonymous gifts still count toward campaign totals and show in your admin records, but keep names off public listings. * Donor Comment block — Invite supporters to leave a public message or words of encouragement (up to 1,000 characters) during checkout. * Tribute and Dedication block — Give donors the option to dedicate gifts “In honor of” or “In memory of” someone special with dedicated honoree fields. * Step Break block — Break long donation forms into clean, multi-step stages with a visual step progress bar and Back/Continue navigation to reduce donor drop-off. * Goal Progress bar block — Display real-time progress toward your fundraising target to encourage community momentum. * Charity Donation template — Launch in seconds using a pre-configured template that includes preset tiers, contact details, dedications, comments, and payment buttons ready to go. Interactive Donor Wall (Pro) Build social proof, inspire more gifts, and celebrate community generosity directly on your campaign pages (requires WPSmartPay Pro): * Public donor listings (Pro) — Display donor names, contribution amounts, comments, dedication tributes, dates, and avatars (Gravatar or initials). * Flexible view options (Pro) — Sort contributors by recent donations or spotlight top donors. * Full donor privacy control — Donors can choose to remain anonymous during checkout or toggle their public display preferences from their donor account. * Comment moderation (Pro) — Review donor comments before they go live, with approve/hide actions right inside your campaign dashboard. * Embed anywhere (Pro) — The donor wall appears automatically on campaign pages, or place it on any page or post using the WPSmartPay Campaign Donors (Pro) Gutenberg widget block or [smartpay_campaign_donors id="..."] shortcode. Campaign Management and Recurring Donations Organize, manage, and track all your nonprofit payments in one place: * Independent fundraising campaigns — Group donation forms under dedicated campaigns with custom target goals, deadlines, and standalone campaign landing pages. * One-time donations — Accept one-time gifts in the free plugin via PayPal Standard or manual/free payment flows. * Recurring donations (Pro) — Accept recurring donations on preset subscription intervals (weekly, monthly, or yearly) through Stripe and Paddle gateways. * Custom amount recurring billing (Pro) — Give donors full flexibility to choose both custom gift amounts and their preferred frequency (daily, weekly, monthly, or yearly) on a single form. * Campaign reports and analytics (Pro) — Detailed campaign performance metrics with CSV data export. * Separate donor and customer records — Any form linked to a campaign or marked as a donation automatically categorizes contributors under SmartPay → Contacts → Donors and records gifts in SmartPay → Transactions → Donations, keeping donation records clean from product sales. * Automated donation receipts — Send immediate branded email confirmations with gift details, and generate printable PDF receipts (Pro) for donor tax records. * Donor self-service dashboard — Supporter portal where donors can view their lifetime giving history, manage or cancel recurring plans (Pro), and update payment details. Anti-Spam Protection Stop bot abuse before it reaches your payment processor. Choose from 3 built-in integrations: Cloudflare Turnstile — Privacy-first, invisible to real users hCaptcha — GDPR-compliant with high bot-detection accuracy reCAPTCHA v3 — Score-based, never interrupts real customers Tax Control Stay compliant without extra plugins: Percentage or fixed-amount tax rates Apply globally or per payment form Tax line shown clearly on checkout and receipts Reports and Analytics Dashboard overview (free) — Total revenue, payment count, recent transactions, and key stats Advanced reports (Pro) — Tabbed reports for Revenue, Forms, Subscriptions, Goals, and Payment Recovery Date-range filters: today, this week, this month, custom Per-form conversion and revenue breakdown Explore Pro reporting CRM and Marketing Integrations (Pro) Connect WPSmartPay to your marketing stack and automate post-payment workflows. Mailchimp — Add customers to lists and tags on payment MailerLite — Sync subscribers and trigger automations FluentCRM — Tag contacts and trigger sequences in your WordPress CRM AffiliateWP — Track affiliate referrals on every payment Zapier — Connect to 6,000+ apps with no code Pabbly Connect — Automate workflows with multi-step triggers See all integrations Course and Membership Integrations (Pro) Sell courses and memberships without a separate checkout — payment and enrollment happen in one step. LearnDash — Enroll students in a course the moment payment clears Tutor LMS — Grant course access automatically on successful payment LifterLMS — Unlock memberships and courses after checkout AI Agent Integration (Pro) WPSmartPay Pro is built for the agentic web. Connect Claude, Cursor, or any MCP-compatible AI agent to your payment operations — no API scripting required. Agents can take real actions inside your site using the built-in Model Context Protocol (MCP) server: Create payment forms from a prompt — agent scaffolds the full Gutenberg form with pricing tiers in seconds Query payments and customers — ask your agent to find a customer, pull recent transactions, or check payment status Create and send invoices — agent drafts an invoice and fires it to the customer by email in one step Generate coupon codes — bulk-create codes with custom prefixes, limits, and expiry from a single instruction Manage subscriptions — list active subscriptions or cancel one by customer email Use Claude, ChatGPT, Codex, Cursor, or any tool that speaks Model Context Protocol. No webhooks or custom scripts needed — the MCP endpoint is built into the plugin. Learn how to connect an AI agent Who Is WPSmartPay For? Freelancers and Agencies — Invoice clients and accept one-time or recurring service payments Coaches and Consultants — Charge for sessions, courses, and memberships Nonprofits and Charities — Accept one-time and recurring donations, run fundraising campaigns with goal tracking, and recognize supporters on donor walls Content Creators — Sell eBooks, templates, audio, and digital files Event Organizers — Ticket sales and event registrations Fitness and Wellness Studios — Sell subscription and class packages Free Features at a Glance Native Gutenberg payment and donation form builder with live preview Ready-to-use form templates (including Charity Donation template) Dedicated donation form blocks: Give Anonymously, Donor Comment, Tribute, and Step Break Campaign Goal Progress block with real-time visual progress bar Dedicated fundraising campaigns with target goals, deadlines, and public campaign pages One-time donation collection with preset giving tiers and custom amounts Separate Donors directory and Donations transaction log Donor giving history tab in the customer dashboard Invoice management (create, send, track) Anti-spam protection: Cloudflare Turnstile, hCaptcha, reCAPTCHA v3 Tax and surcharge control system Dashboard reports and analytics Customizable email receipts and notifications Guided onboarding wizard Support and system info page Customer and contact management Coupon codes with percentage or fixed discounts PayPal Standard + manual/free payment gateway Per-gateway test and sandbox mode GDPR-friendly data handling Developer hooks, filters, and REST API WPSmartPay Pro Unlock more with WPSmartPay Pro: Pro Payment Gateways: Stripe – Authorize.net – Paddle – Razorpay – Mollie – bKash – toyyibPay – Paytm Donations and Fundraising (Pro): * Interactive public donor wall (Pro) on campaign pages * WPSmartPay Campaign Donors Gutenberg widget block and shortcode embed (Pro) * Donor wall moderation with comment approval queue (Pro) * Recurring donations (Pro) on fixed intervals (weekly, monthly, annual) * Custom amount recurring billing (Pro) via donation pricing blocks (let donors pick gift amount and frequency: daily, weekly, monthly, yearly) * Donor self-service management (Pro) (donors can view and cancel their recurring gifts) * Campaign performance analytics report with CSV export (Pro) * Printable PDF donation receipts (Pro) * Private administrative notes on donor profiles (Pro) Subscriptions and Recurring Billing: * Recurring plans on forms and products * Billing cycles and installment plans * Renewal reminder emails Advanced Coupon Management: * Bulk coupon generation with custom prefix/suffix and quantity * CSV export of generated codes * Per-coupon and per-customer usage limits * Percentage or fixed discounts with expiry dates Outgoing Webhooks: * Fire payment events to any URL in real time * HMAC-SHA256 signed requests (Standard Webhooks spec) * Automatic retry with delivery log * Works with Zapier, Make, n8n, and custom endpoints Advanced Reports: * Revenue, Forms, Subscriptions, Goals, and Recovery tabs * Per-form conversion and revenue breakdown * Failed/abandoned payment recovery tracking Marketing and Automation Integrations: Mailchimp – MailerLite – FluentCRM – AffiliateWP – Pabbly – Zapier Course and Membership Integrations: LearnDash – Tutor LMS – LifterLMS AI Agent Integration (MCP): * Built-in Model Context Protocol server * AI agents can create forms, query payments, send invoices, manage coupons and subscriptions * Works with Claude, Cursor, and any MCP-compatible client Get WPSmartPay Pro Gateway Coverage Stripe (Pro) — 47+ countries, 135+ currencies PayPal — 200+ countries, 25 currencies Authorize.net (Pro) — US and Canada; USD, CAD, GBP, EUR and more Mollie (Pro) — European Economic Area (EEA) Paddle (Pro) — Global merchant of record; handles VAT and sales tax worldwide Razorpay (Pro) — India, 100+ currencies toyyibPay (Pro) — Malaysia (MYR) Paytm (Pro) — India (INR) bKash (Pro) — Bangladesh (BDT) Documentation: docs.wpsmartpay.com Blocks This plugin provides 4 core Gutenberg blocks and a suite of native form builder blocks: SmartPay Form Embed any payment, donation, or fundraising form into your pages, posts, or landing pages. SmartPay Product Display and sell digital downloads and products with instant checkout. Campaign Goal Progress Display a live visual progress bar showing funds raised toward a fundraising campaign target. Campaign Donors (Donor Wall) (Pro) Showcase public donors, contributions, and messages of support on any campaign or landing page. Requires WPSmartPay Pro.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C