NetSendo v2.7.2: SMS Campaigns Fixed & Security Hardening

Picture this: you write a carefully timed SMS for a flash sale, click Send now, and watch the campaign switch to "sent". Your customers never get a single message. For NetSendo users who sent SMS from the panel, that was happening every time, and nothing on screen showed it.

NetSendo v2.7.2 fixes this. It also repairs test SMS, the send_sms MCP tool for AI assistants and the WordPress plugin. And it closes three gaps where one user's data or sending accounts could cross into another user's account on a shared instance.

🚀 What's New in v2.7.2

SMS Campaign Scheduling, Rebuilt

Before this release there were three separate bugs. Think of them as three doors that were all locked.

• Send now saved the campaign as sent. The SMS cron only picks up scheduled campaigns, so nothing went out.
• Schedule wrote your chosen date to send_at, but the cron reads scheduled_at. Scheduled SMS went out at the next cron run instead of the time you picked.
• Queue (autoresponder) SMS saved as active stayed in sent status and never ran.

Now "Send now" saves the campaign as scheduled with scheduled_at set to the current time. "Schedule" takes the time in your timezone and stores it in UTC. Queue SMS are saved as scheduled and active. The edit form shows the scheduled time in your timezone.

Test SMS and the SMS API

The "Send test SMS" button passed message: to the SMS providers, but they expect content:. That mistake caused a PHP error that the catch (\Exception) block didn't catch. It's fixed now.

POST /api/v1/sms/send had the opposite problem: the MCP client sent content, but the endpoint required message, so it returned 422. The endpoint now accepts both field names, and a subscriber_id is enough on its own:

curl -X POST https://your-netsendo.example.com/api/v1/sms/send \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"subscriber_id": 42, "message": "Your order has shipped!"}'

Error responses are clearer too. A subscriber that belongs to another account returns 404. A phone number that no contact has returns 422 instead of 500.

WordPress Plugin 1.1.2

Plugin 1.1.2 fixes two problems:

• The plugin sent list_id, but the API requires contact_list_id. Every signup and content-gate unlock failed.
• "Subscribers only" gates treated the single subscriber returned by the API as a list, so they never recognised anyone.

You can download 1.1.2 under Marketplace → WordPress → Download Plugin. Sites with the plugin already installed are offered the update.

Security Fixes

When the default mailbox or SMS provider couldn't be used, NetSendo looked for another active one with this raw condition. The parentheses were missing:

// Before: the OR escaped the user condition
->whereRaw('daily_limit IS NULL OR sent_today < daily_limit')

// After: the condition is grouped
->whereRaw('(daily_limit IS NULL OR sent_today < daily_limit)')

Because of this, a campaign could go out through another user's mailbox or SMS account. Two more API endpoints also checked ownership too loosely:

• POST /api/v1/subscribers accepted tag IDs from other accounts. Tags must now belong to the API key's account, which was already the rule for lists.
• POST /api/webhooks/purchase could match a contact's email in any account. Now it only searches the API key's account.

⚠️ Important: If several users or clients share your NetSendo instance, install this update as soon as possible. The fallback bug could send one tenant's campaign through another tenant's mailbox or SMS account.

💼 Benefits & Use Cases

🛠️ Step-by-Step Upgrade Guide

1. Pull and restart

   Run the commands below. No configuration files change, and there are no migrations since 2.7.1.

   docker compose pull && docker compose up -d

2. Re-queue stuck SMS campaigns

   SMS campaigns saved with status sent before this release are not re-sent automatically. Open each one and save it again, or click Send again.

3. Check queue SMS

   Re-save autoresponder SMS so they are stored as scheduled and active.

4. Send a test SMS

   Send a test to your own number. If the provider rejects it, you'll now see the real error, such as a sender ID or credit problem.

5. Update the WordPress plugin

   Accept the 1.1.2 update in WordPress, or download it from Marketplace → WordPress → Download Plugin. Then test one signup form and one content gate.

6. Review API integrations

   If your scripts send tag IDs from other accounts or rely on matching purchases across accounts, those calls will now fail or find no contact. Update them to use IDs from the API key's own account.

ℹ️ Note: Before re-queuing old campaigns, check that their content is still relevant. A promotion that has already expired should be edited or deleted, not sent.

✅ Conclusion

v2.7.2 fixes SMS for panel campaigns, test sends, the API and the MCP tool. It brings back WordPress signups and content gates, and it tightens account isolation for shared instances. The release ships with new tests: SmsCampaignSchedulingTest, SmsSendApiTest, ProviderFallbackOwnerScopeTest and ApiAccountScopeTest.