WP Helper Premium · Version history
WP Helper Premium changelog and version history
- Latest version
- 4.7.8
- Sep 9, 2026 (2 months ago)
- Releases
- 17
- since 2021
- In the last year
- 9
- about one every 9 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
Releases each year
- 20215 releases
- 20222 releases
- 20231 release
- 20269 releases
20269 releases
WP Helper Premium 4.7.8Latest
- i18n: added the missing English (en_US) translation for 161 strings introduced since the last full translation pass — mainly in Security Advisor, SEO Advisor, AI Payment, the e-wallet gateways (MoMo, ZaloPay, VNPay, ShopeePay), and the Ministry of Industry and Trade (Bộ Công Thương) module. English…
WP Helper Premium 4.7.7
- New: e-wallet payment methods (MoMo, ZaloPay, VNPay, ShopeePay) are now registered with the WooCommerce Checkout Block (Cart & Checkout blocks), not just the classic shortcode checkout.
- Fixed: an e-wallet enabled from the plugin’s own Wallet settings page could silently be missing from the Block Checkout — while still showing on the classic checkout — because the block integration didn’t fall back to the gateway’s default “enabled” state the same way WooCommerce’s classic settings…
- Fixed: two “Company”/”Address line 2” checkout-field visibility toggles are now synced to the Checkout Block as well as the classic checkout.
- Fixed: corrected inaccurate help text on the Wallet settings page that referenced an API key, even though these gateways only use an account name/phone number and a QR code image.
- Fixed: clicking “Settings” for a wallet gateway that hasn’t been saved as enabled yet used to open a blank WooCommerce settings page; it now shows an inline warning instead.
- Confirmed compatibility with WordPress 7.1.
WP Helper Premium 4.7.6
- Security: fixed a server-side request forgery (SSRF) issue in the bank-transfer confirmation flow — a crafted receipt URL could previously cause the server to fetch internal or cloud-metadata addresses; URLs are now validated against private and link-local IP ranges both when the URL is saved and a…
- Security: closed a residual SSRF path in the Ministry of Industry and Trade registration badge check — a redirect returned by the official endpoint could previously be followed to an external host; each redirect hop is now re-validated before it is followed.
- Security: replaced a legacy parallel-download routine that disabled SSL certificate verification with the WordPress HTTP API, removing a man-in-the-middle exposure when fetching AI-suggested images.
- Security: added a short-lived, single-use guard against request replay on the background AI Writer AJAX endpoint.
- Security: all bundled third-party libraries (CodeMirror, Font Awesome, jQuery DirtyForms, SheetJS) are now shipped locally with the plugin instead of being loaded from external CDNs at runtime.
- Security: the AI Payment Vision-based receipt verification endpoint now checks that AI Payment/OCR is actually enabled before running, instead of relying solely on the admin UI to hide the button.
- Security: bank-transfer confirmation is now rejected for orders that aren’t using a wallet or bank-transfer payment method.
- Security: CSV/spreadsheet exports (Form Manager) now neutralize leading =, +, -, @ characters in exported values to prevent formula injection when the file is opened in Excel or Google Sheets.
- Security: the plugin’s own admin pages no longer suppress admin notices from WordPress core or other plugins.
- Improve: self-hosted the Google Fonts used on the Maintenance Mode and thank-you page templates — visitor IP addresses are no longer sent to Google when those pages are viewed.
- Fix: removed a leftover Google Fonts CDN link that was still being enqueued alongside the self-hosted version on the thank-you page, which had kept sending visitor requests to Google.
- Fix: the Pop-up module’s stylesheet was loading a Google Fonts CDN link on every page — even with Pop-up disabled — instead of the font already bundled with the plugin; it now loads locally.
- Fix: AI Payment receipt images stored in the site’s own uploads folder are no longer incorrectly blocked by the SSRF safety check on local/dev/LAN environments.
- Fix: the Ministry of Industry and Trade registration badge check no longer intermittently times out on sites where the official endpoint requires several redirect hops.
- Fix: the Ministry of Industry and Trade badge “Check” action now saves the verified link together with the registration status, so the public badge always links to the link that was actually verified.
- Fix: badge detection on the homepage now checks every online.gov.vn link found on the page instead of stopping at the first one, avoiding a false “not registered” result.
- Fix: “Resend” on a logged email now includes its original attachments, which were previously dropped.
- Fix: added a setting to actually disable email logging from the Email Log screen; it could previously only be turned off by editing the database directly.
- Fix: the Email Log “maximum log count” setting is now enforced by the daily cleanup job, in addition to the existing retention-by-days setting.
- Fix: the Email Log detail popup now escapes email subject/address/SMTP response before rendering, for consistency with the Spam Filter and CAPTCHA log popups.
- Fix: the AI Payment Vision rate limit is now applied only once a receipt image has actually been fetched, instead of blocking retries after an early validation failure.
- Fix: corrected inconsistent text-domain usage across several files so all translatable strings load under the plugin’s own text domain.
- Fix: uninstalling the plugin now also removes a leftover database table, four WooCommerce wallet options, remaining transients, and scheduled cron events (including a pending AI Writer background job), so no data is left behind.
- Docs: added a Frequently Asked Questions section to this readme.
- Docs: disclosed the Telegram, Discord, and custom-webhook notification channels used by the optional AI Payment module in the External Services section — these were previously undocumented.
- Docs: disclosed Pollinations.ai and Picsum.photos, the no-API-key image fallback used automatically by AI Writer, in the External Services section — these were previously undocumented.
- Docs: disclosed the online.gov.vn request made by the Ministry of Industry and Trade registration badge check in the External Services section.
WP Helper Premium 4.7.5
- Fix: the AI Payment page showed “undefined” in every label and verification result panel — caused by a duplicate i18n object where the wrapping tab overwrote the sub-tab’s translation strings.
- Fix: order-received (thank-you) page — a receipt image is now required before confirming a bank transfer when AI OCR is enabled; transfer confirmation is blocked on orders already processed by an admin; the page now syncs its state (button, banner, status badge) automatically right after confirmati…
- Fix: the close icon on the “Contact support” popup on the thank-you page was visually distorted due to a missing CSS box-sizing rule.
- Fix: the close (X) button on the “AI SEO Scan” confirmation popup was unclickable, hidden behind a decorative overlay.
- Fix: AI SEO Scan no longer invents non-existent internal links — suggestions are now limited to real posts/pages/products on the site and re-validated before being shown.
- Fix: AI SEO Scan no longer auto-inserts placeholder headings and content into a post when clicking Apply — suggested headings are shown for reference only, for the user to add manually.
- Fix: AI SEO Scan for Products now reads the correct product category taxonomy (product_cat) instead of the post category taxonomy, improving suggestion quality.
- Fix: corrected a malformed SVG icon that triggered a browser console error in the SEO scan confirmation popup.
- Improve: AI Payment quick actions (Confirm / Suspect / Reject / Request receipt) now warn clearly when the customer notification email could not be sent (missing billing email), instead of silently reporting success.
WP Helper Premium 4.7.4
- Fix: Pop-up not showing on freshly installed sites running PHP 8 even when enabled — a loose comparison ('' == 0) evaluates to false on PHP 8 (unlike PHP 7), so the Pop-up template selector (Newsletter/Banner) failed to match. Default values are now normalized, self-healing even on sites that alrea…
- Fix: the on/off toggles (Pop-up, Contact Channels, SMTP, Maintenance…) and the Save button now proactively purge page cache (LiteSpeed, WP Rocket, W3TC, WP Fastest Cache, Breeze, SG Optimizer, Swift Performance) right after saving, preventing full-page-cache sites from showing stale settings.
- Fix: removed leftover internal debug routes /feedback and /feedback/api from the dev environment, which could incorrectly intercept a client site’s real content if the path collided.
WP Helper Premium 4.7.3
- Security: the AI connection form no longer pre-fills the saved API key (previously exposed via View Source despite password masking); the field stays empty and shows a placeholder hint when a key is already saved, so only pasting a new value updates the connection.
- Fixed: broken image on the login logo preview and the real login page when the previously selected logo had been deleted from the media library; added a file-existence check with fallback to the plugin’s default logo.
- Improved: moved the maintenance-mode warning notice to the top of the Pop-up settings page so it’s visible before scrolling.
WP Helper Premium 4.7.2
- Security fix: unauthenticated /wp-admin requests were being redirected through the custom login URL slug, exposing it to anyone probing the default admin path and defeating the purpose of hiding the login URL. Blocked access now redirects to the homepage instead.
- Fixed: the custom login URL feature was incorrectly intercepting admin-ajax.php and admin-post.php requests, breaking public AJAX/form submissions (contact forms, popups, WooCommerce) for logged-out visitors.
- Fixed: Spam Filter “Detect code/script content” level selector was unreachable while its toggle was off, its dropdown menu could be clipped, and its on/off label could fail to update on click due to a JS scoping bug affecting all Spam Filter toggles.
WP Helper Premium 4.7.1
- Fixed: fatal PHP parse error on PHP 7.4 servers caused by a PHP 8.0-only match() expression in the AI Payment verified-stats handler; replaced with a switch statement for broad host compatibility.
WP Helper Premium 4.7
- Added AI Hub module with multi-provider support (Gemini, Claude, OpenAI) and 3-tier fallback chain.
- Added Spam Filter module with honeypot, rate limiting, IP/country blocking, keyword filtering.
- Added Email Log module to track all outgoing emails with SMTP diagnostics.
- Added Captcha module supporting Math Quiz, Google reCAPTCHA, Cloudflare Turnstile, and hCaptcha.
- Added Form Manager module to collect and manage form submissions.
- Added Maintenance Mode module with 5 customizable templates and AI content generation.
- Added AI Payment module for WooCommerce: OCR receipt verification, fraud detection, risk alerts.
- Added AI Token Statistics page with usage tracking per provider.
- Security: added ABSPATH guard to all PHP files.
- Security: all user-supplied data in database queries uses $wpdb->prepare().
- Added uninstall.php to clean up all plugin data on deletion.
- Fixed: toggle is locked/disabled when AI provider is not connected.
- Fixed: eye icon on API Key input now toggles correctly between show/hide states.
- i18n: added full English (en_US) translation.
20231 release
WP Helper Premium 4.4
20222 releases
WP Helper Premium 4.3
WP Helper Premium 4.0.1
20215 releases
WP Helper Premium 3.2
WP Helper Premium wp-helper-lite-3-2
WP Helper Premium wp-helper-lite-3-1.zip
WP Helper Premium wp-helper-lite-3-0.zip
WP Helper Premium wp-helper-lite-2-3.zip
Questions about WP Helper Premium’s releases
What is the latest version of WP Helper Premium?
4.7.8, released on Sep 9, 2026 (2 months ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is WP Helper Premium updated?
9 releases in the last year, about one every 9 days. Its first release on WordPress.org dates from January 2021.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in WP Helper Premium’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.