Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification

Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Protection Mechanism Failure.

Every one of the 2 issues recorded for Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-88828

Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass

Read the full analysis

Vulnerability Records

2 records
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification banner
Latestv2.3.4

Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification

YoOhw Studio

Author

YoOhw Studio

3.6(14)
72/100
Last Updated
2026-10-15 (5d ago)
Active Installs
2,000+
Downloads
80,825
Requires WP
6.3+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2024-01-18 (3y ago)

Blacklist Manager is a WooCommerce blacklist, anti-fraud, and spam prevention plugin for stores that need to block fake orders, suspicious customers, spam registrations, and unwanted form submissions. The free plugin is a complete local protection toolkit, not a Premium trial. Use blacklist rules for phone numbers, email addresses, IP addresses, and email domains at WooCommerce checkout, registration, comments, product reviews, REST API orders, and supported WordPress forms. The plugin works with WooCommerce Classic Checkout, WooCommerce Checkout Blocks, Contact Form 7, Gravity Forms, and WPForms. What the free plugin includes Manage local email, phone, IP address, and email-domain entries through Suspects and Blocklist workflows. Stop matching identities at WooCommerce checkout and protect registration, comments, product reviews, supported forms, and WooCommerce REST API orders. Require built-in checkout email verification for the policies you configure. Core owns and runs email verification; phone OTP and Twilio/TextMagic SMS transport belong to Blacklist Manager Premium. Configure free customer notices and admin alerts, then review dashboard blacklist and detection statistics. Documentation | Support | Demo Key Features WooCommerce checkout protection: Block or review orders using phone, email, IP address, and email domain rules. Suspect and blocked lists: Review risky identities before moving confirmed abuse to the blocklist. Fast blacklist management: Add entries from the dashboard or directly from the WooCommerce order screen. Registration protection: Stop signups that match blocked emails, IP addresses, or email domains. Comment and review blocking: Prevent comments and product reviews from blacklisted emails. Form spam protection: Check Contact Form 7, Gravity Forms, and WPForms submissions against blacklist data. Checkout email verification: Require a Core-owned email verification code before allowing checkout to continue. WooCommerce REST API protection: Block blacklisted identities from creating orders through external apps or integrations. Custom notices and alerts: Customize customer-facing block messages and admin email alerts. Dashboard stats: Review blacklist entries and detection attempts from the admin area. Checkout Compatibility Blacklist Manager supports WooCommerce Classic Checkout, WooCommerce Checkout Blocks, and many third-party checkout plugins that use standard WooCommerce checkout and order creation flows. Global Blacklist Decisions Blacklist Manager can optionally connect your store to Global Blacklist Decisions, a separate broader-risk service that checks order identities such as email, phone, IP address, address, and email domain against network data. It is not required for local Core protection and is not a prerequisite for Premium. Learn more about Global Blacklist Decisions Premium Features Consider Blacklist Manager Premium when recurring abuse makes manual blacklist maintenance too time-consuming, when checkout or payment patterns need automatic action, when repeat attackers change individual identity fields, or when your team needs deeper investigation and audit tools. Premium is the advanced local/store extension. It adds: Risk scoring for blacklist, identity, IP, address, payment, device, and order pattern signals. Automation rules to auto-suspect, auto-block, or auto-review orders. Payment intelligence for Stripe, PayPal, Mollie, Braintree, WooPayments, AVS, card country, and payer mismatch signals. Device identity checks to link repeat abuse across emails, phones, IPs, addresses, and accounts. Advanced blocking for customer name, address, device, disposable email, disposable phone, country, VPN, and proxy signals. Activity logs, import/export, cleanup tools, permissions, multi-store sync, CAPTCHA, IP intelligence, geocoding, and email validation integrations. Phone OTP runtime and Twilio/TextMagic SMS transports; Core continues to own checkout email verification. Explore Premium Supported Plugins and Integrations Supported plugins WooCommerce Contact Form 7 Gravity Forms WPForms Premium integrations WooCommerce Stripe Gateway, Payment Plugins for Stripe WooCommerce, WooCommerce PayPal Payments, Payment Plugins for PayPal WooCommerce, Braintree for WooCommerce, Mollie Payments for WooCommerce, and WooPayments. Cloudflare, reCAPTCHA v3/v2, hCaptcha, IP-api, BigDataCloud, ZeroBounce, NumCheckr, Google Maps, Twilio, and TextMagic. Use Cases Block fake WooCommerce orders before payment review. Prevent repeat abuse from known phone numbers, email addresses, IP addresses, and domains. Reduce spam registrations, comments, product reviews, and form submissions. Require Core email verification during checkout without installing Premium. Add Premium phone OTP when a store also needs SMS-based phone ownership checks. Review suspicious customers before moving them to the blocklist. Use Global Blacklist Decisions as an additional fraud signal.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C