WP Helper Premium
WP Helper Premium has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 6 issues recorded for WP Helper Premium has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. WP Helper Premium is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
WP Helper Premium <= 4.2.0 - Authenticated (Contributor+) SQL Injection
Read the full analysisVulnerability Records
WP Helper Premium
Author
Mat Bao Corporation
WP Helper Premium is an all-in-one WordPress toolkit that consolidates 8 essential site management modules into a single plugin. Every module is independent — activate only what you need from a unified dashboard. Contact Channels Add a floating contact widget so visitors can reach you instantly. Greeting card — title, short description, and online/offline status Floating trigger button — custom color and left/right position Hotline card — separate info for online and offline hours Staff list — multiple agents with names and contact info Header & Footer Inject tracking, analytics, or custom code without editing theme files. Three code areas — <head>, body-open (<body>), and footer (</body>) Supports any HTML, JavaScript, or CSS snippet Applies site-wide and survives theme updates Pop-up Promotional and newsletter pop-ups with full scheduling and display control. Form pop-up — collects leads, integrates with Contact Form 7, WPForms, Gravity Forms, Ninja Forms Banner pop-up — image, title, subtitle, and CTA button Display rules — delay, cookie duration, and max display count Maintenance Mode Put your site under a professional maintenance page while you work. 6 templates — Dark, Light, Gradient, Construction, Corporate, Cyberpunk (Neon) AI content generation — auto-writes heading, sub-heading, and description (requires AI Hub) Countdown timer — shows visitors when the site returns Visitor stats — page views, unique visitors, and bounce rate while active Admin bypass — logged-in administrators see the site normally Email & Contact Manage every inbound form and outbound email from one place. Form Manager — collect, view, and export contact form submissions SMTP Config — reliable delivery via Gmail, Outlook, Zoho Mail, Yahoo Mail, or any custom SMTP server Spam Filter — honeypot, rate limiting, IP/country/keyword blocking, DNSBL check CAPTCHA — Math Quiz, Google reCAPTCHA, Cloudflare Turnstile, or hCaptcha Email Log — status, headers, and body of every email sent, with resend and CSV export WooCommerce Toolkit Extend WooCommerce with sales and operations tools — no extra plugins needed. Wallet Payment — Momo, ZaloPay, VNPay, ShopeePay Payment Templates — reusable info blocks for order/CRM management E-commerce Links — connect product listings to Shopee, Lazada, TikTok Shop Buy Now (CTA) button — custom placement and text on product pages Thank You page — customize post-purchase content AI Payment Verification — scan bank transfer receipts via OCR to auto-verify payments and flag fraud (requires AI Hub) AI Hub Connect Google Gemini, Anthropic Claude, or OpenAI GPT to power AI features site-wide. AI Writer — drafts blog posts and product descriptions AI Security — scans the site for vulnerabilities and misconfigurations AI SEO — audits pages and suggests on-page SEO improvements AI Payment — verifies bank transfer receipts via OCR and flags fraud risk Token stats & fallback — tracks usage per provider with automatic 3-tier fallback Protection & Optimization Harden and speed up your site with individual toggles — enable only what you need. Security — disable XML-RPC, hide WP version, custom login URL, disable copy/right-click Performance — remove query strings, disable embeds, Google Fonts, or Dashicons Productivity — duplicate pages/posts/menus, redirect 404s to the homepage, enable SVG uploads Privacy Policy This plugin does not track users, store personal data, or use cookies by default. Certain optional features transmit data to third-party services — see External Services below. All external calls are initiated server-side; most occur only when the relevant feature is enabled and configured with an API key by a site administrator, except the AI Writer image fallback (Pollinations.ai / Picsum.photos) described below, which requires no API key and runs automatically whenever AI Writer generates article images. External Services This plugin optionally connects to the following third-party services when the corresponding features are enabled by the site administrator. No data is sent unless the feature is explicitly activated and configured. Google Gemini API Used for AI-powered content generation (maintenance page content, product descriptions, image captions). Data sent: text prompts provided by the administrator. * Service: https://ai.google.dev/ * Terms of Service: https://ai.google.dev/terms * Privacy Policy: https://policies.google.com/privacy Anthropic Claude API Used as a fallback AI provider for content generation when configured by the administrator. * Service: https://www.anthropic.com/ * Terms of Service: https://www.anthropic.com/legal/consumer-terms * Privacy Policy: https://www.anthropic.com/legal/privacy OpenAI API Used as an optional AI provider for content generation when configured by the administrator. * Service: https://openai.com/ * Terms of Service: https://openai.com/terms * Privacy Policy: https://openai.com/privacy ip-api.com Used by the Spam Filter feature to look up the country/ISP of a visitor’s IP address when country-based blocking is enabled. Only the visitor’s IP address is transmitted. * Service: https://ip-api.com/ * Terms of Service: https://ip-api.com/docs * Privacy Policy: https://ip-api.com/ Google reCAPTCHA Used by the Captcha module when the administrator selects Google reCAPTCHA. Visitor IP and browser information are sent to Google for spam scoring. * Service: https://www.google.com/recaptcha/ * Terms of Service: https://policies.google.com/terms * Privacy Policy: https://policies.google.com/privacy Cloudflare Turnstile Used by the Captcha module when the administrator selects Cloudflare Turnstile. Challenge tokens are verified server-side with Cloudflare. * Service: https://www.cloudflare.com/products/turnstile/ * Terms of Service: https://www.cloudflare.com/terms/ * Privacy Policy: https://www.cloudflare.com/privacypolicy/ hCaptcha Used by the Captcha module when the administrator selects hCaptcha. Challenge responses are verified server-side with hCaptcha. * Service: https://www.hcaptcha.com/ * Terms of Service: https://www.hcaptcha.com/terms * Privacy Policy: https://www.hcaptcha.com/privacy Pexels API Used to search and import free stock photos for AI-generated pages when the administrator has configured a Pexels API key. * Service: https://www.pexels.com/ * Terms of Service: https://www.pexels.com/terms-of-service/ * Privacy Policy: https://www.pexels.com/privacy-policy/ Pixabay API Used to search and import free stock photos as an alternative image source when configured by the administrator. * Service: https://pixabay.com/ * Terms of Service: https://pixabay.com/service/terms/ * Privacy Policy: https://pixabay.com/service/privacy/ Pollinations.ai Used by AI Writer to automatically generate an article image from the article’s own text prompt whenever Pexels/Pixabay are not configured or return no result. No API key is required — this call happens automatically as part of AI Writer’s image step, with no separate toggle. Data sent: an AI-generated image prompt derived from the article content. * Service: https://pollinations.ai/ * Terms of Service: https://pollinations.ai/ * Privacy Policy: https://pollinations.ai/ Picsum.photos Used by AI Writer as a final placeholder image source when no other image source (Pexels, Pixabay, Pollinations.ai) returns a usable image. No API key is required and no article content is sent — only a random seed value used to pick a placeholder photo. * Service: https://picsum.photos/ * Terms of Service: https://picsum.photos/ * Privacy Policy: https://picsum.photos/ online.gov.vn Used by the Ministry of Industry and Trade (Bộ Công Thương) registration badge module, part of the WooCommerce Toolkit, to verify that a registration/notification link entered by the site administrator is a genuine online.gov.vn page and actually corresponds to the current website’s domain. Data sent: the online.gov.vn URL provided by the administrator (or, as a fallback, a request to the site’s own homepage to detect an existing badge link). No personal data is transmitted. * Service: https://online.gov.vn/ * Terms of Service: https://online.gov.vn/ * Privacy Policy: https://online.gov.vn/ Telegram Bot API Used by the optional AI Payment module, when the administrator enables the Telegram notification channel and supplies their own bot token and chat ID, to alert staff about a customer’s bank-transfer confirmation. Data sent: order number, customer name, phone number, order total, and — when provided by the customer — the sender name, bank, last 4 account digits, and receipt image URL. * Service: https://core.telegram.org/bots/api * Terms of Service: https://telegram.org/tos * Privacy Policy: https://telegram.org/privacy Discord Webhook Used by the optional AI Payment module, when the administrator enables the Discord notification channel and supplies their own channel webhook URL, to alert staff about a customer’s bank-transfer confirmation. Data sent: order number, customer name, phone number, order total, and — when provided by the customer — the sender name, bank, last 4 account digits, and receipt image URL. * Service: https://discord.com/ * Terms of Service: https://discord.com/terms * Privacy Policy: https://discord.com/privacy Custom Webhook (AI Payment) When the administrator configures a custom webhook URL under the AI Payment module, the same bank-transfer confirmation data (order ID, order number, customer name, phone, order total, sender name, bank, last 4 account digits, and receipt URL) is sent to that URL as JSON. * Service: administrator-supplied URL * Terms of Service: n/a (destination controlled by the site administrator) * Privacy Policy: n/a (destination controlled by the site administrator)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C