Jan Dembowski on "[Plugin: User Submitted Posts] Is this plugin easily "

Glad to help:

"what is a bit amateurish is for you just to click resolved in the support section to my query, what sort of support is that!"

There is no need to be rude or offensive, I work very hard to help my users, and have been doing so freely for over 10 years now, always keep it professional. And as explained, I marked the thread resolved because you had said that you deleted the plugin, so I assumed that the issue was "resolved" at that point. I mean typically, after the plugin is uninstalled, there is not much left to do. Dear Lord please forgive me for the mistake.

"I told you of a major hack/issue and you could not care less."

A couple of points here:

- If you actually did think that there was a security issue with the plugin, you should have reached out to the developer privately first. This is standard WordPress best practice, please read the official documentation:

https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/

- To say that I "could not care less" is inaccurate and unfair. I am on the only vacation I have taken with my family in several years. And what I am doing? Sitting here hunched over some shoddy wi-fi in a train station trying to help one of my users. Instead of enjoying myself and spending time with my wife and child, I am going out of my way to try and help you. Please do not say that I could care less.

"I imagine many people using this are getting posts posted on their site in this manner without knowing."

Yeah but you see, it's not happening to anyone else. That's what I've been trying to tell you. The plugin has over 20,000 users and you are the only one that is having any issue with spam postings. So it's fair to say, based on over 10 years experience working with WordPress, that there is something else on your site that is interfering with normal functionality. Otherwise, I would be hearing about this from more than one person. I.e., it's an isolated incident, not something that is a problem with the plugin itself.

"Your plugin has serious vulnerabilities"

No it does not. Please see my previous response. Besides, what you are talking about is spam, which may suck but really isn't anything to panic over. And again, for future reference, if you think that some plugin has a security issue, please reach out privately to the developer before posting anywhere online. Otherwise you could be putting many, many sites at risk.

"When I deactivated the plugin, I soon got about another 100+ articles by user submitted posts!! When I changed captcha to a wrong answer like, what is 9+5 34784789574985749857 I still got submitted articles into my admin area."

This is another reason to suspect that the issue is with something else on your site and not with the plugin. On a healthy site, it is impossible to execute code from an inactive plugin. So most likely your site is compromised in some other fashion.

"Can you explain to us when you have free time after vacation or whatever why this should be and why it's happening. I am 100% sure you know the reason, you must."

Again, the issue is not with the plugin, otherwise -- and trust me when I tell you -- I would be getting bombarded with hundreds of thousands of support tickets. But that's not the case: you're the only one. It's an isolated incident, most likely due to some other issue with your site. Please understand this.

Fortunately, the plugin is very secure, tried, tested, and thoroughly developed for over 5 years now. Again, the issue as you've described it points at a problem with your site, most likely something to do with another plugin, file permissions, server configuration or so forth. So despite your "you must" statement, there is no way for anyone to just "guess" what your problem is without a thorough investigation.

I hope this information makes sense, let me know if I can elaborate on anything.