Plugin Revolution, Sport Exchange & Multi-currency Overhaul

The biggest release in F7Casino history. This update introduces a complete plugin ecosystem, launches a peer-to-peer sports betting exchange, ships eleven new plugins in the store, delivers a platform-wide multi-currency overhaul, and closes more than 50 security issues across two full audits.

🧩 Plugin Ecosystem — Brand New

F7Casino now has a full WordPress-style plugin system. You can extend, replace, or reshape almost any part of the platform — the homepage, the sidebar, the dashboard, the games list, the checkout flow, the admin panel — from inside a plugin, without touching any core files. When the next update ships, your customisations carry over cleanly.

• 763+ extension points across the platform — from login and registration to every bet, deposit, withdrawal, and game result.

• 53 UI injection slots across 23 pages — drop new sections, banners, widgets, or full-page takeovers anywhere you want.

• Replace any page, modal, or widget from a plugin without editing core code.

• Shortcode engine — authors place [shortcode_name] tags inside any text field and plugins render them.

• Per-plugin translations in all 6 supported languages, shipped inside the plugin itself.

• Auto-generated settings UI — each plugin declares its own fields and the admin panel renders the form automatically.

• Enable, disable, and reconfigure plugins from the admin panel with no restart.

🏪 Plugin Store

• Browse, install, update, and purchase plugins directly from the admin panel.

• One-click install — pick a plugin, press install, and the platform handles everything automatically. No SSH. No manual steps.

• Automatic update detection with one-click upgrade when a new version is published.

🆕 Twenty New Plugins

Eleven new plugins are available in the store with this release. Click any name to see its full description, screenshots, and install instructions.

• Sport Exchange (Back & Lay) — A full peer-to-peer betting exchange in the Betfair model. Your players trade outcomes against each other and you earn commission on winnings with zero book risk.

• Agent & Affiliate System — Multi-level agent management with three commission modes, flexible settlement periods, and a dedicated agent dashboard.

• Friends & Activity Feed — Friend requests, public profiles, real-time activity feed, and friends leaderboard with full per-user privacy controls.

• Complaint Management — Ticket system with SLA monitoring, auto-escalation, and real-time messaging between users and admins.

• Email Campaign Manager — Open/click tracking, unsubscribe system, ready-made templates, and a variables engine.

• Anti-Fraud & AML Monitoring — Real-time fraud detection with 8 configurable rules and a full alert workflow.

• Provably Fair Gaming — Cryptographic game fairness with player-controlled seeds and a public verification page.

• Achievements & Badges — 24 pre-configured achievements with automatic progress tracking and rewards.

• Leaderboard & Rankings — Daily / weekly / monthly boards with automatic prize distribution.

• Flash Sales & Limited Offers — Time-limited bonuses with countdown timers and claim limits.

• Winback & Anti-Churn — Automatic inactive-player detection with personalised bonus codes.

💱 Multi-currency Overhaul

The platform now correctly respects each user's own currency across every money flow. Before this release, a user with a non-USD currency who entered a "50" stake would have it converted at the site rate instead of their own — producing wrong values in high-volume cases. That is now fixed everywhere.

• Four pluggable currency rate providers — Free (open.er-api, no API key), ExchangeRate-API, OpenExchangeRates, and CurrencyLayer. Admins can test any provider and key before saving.

• Per-user rates across the whole platform — sports bets, crypto prediction, deposits, withdrawals, game launch, and every game handler (CreateJS, Pragmatic, Relax, Nolimit, Yggdrasil, Greentube, PG, V-Games, Sport Exchange) now use each session user's own currency and rate.

• Rate cache with 6-hour TTL and instant clearing when the provider or API key changes.

• 
  

• 

🛡️ Security — More Than 50 Fixes

Two full security audits were conducted covering every critical, high, medium, and low-severity issue. Highlights:

• Table game wins are now computed server-side instead of being accepted from the client.

• The settings API was exposing payment gateway credentials and SMTP passwords to any caller — this has been completely closed and all sensitive fields are now masked.

• Public API endpoints that were leaking OAuth secrets, API keys, and internal configuration to unauthenticated visitors have been closed.

• Closed a SQL injection hole in the Aviator engine.

• Closed an IDOR vulnerability on a chat endpoint that exposed full user records without authentication.

• Fixed deposit double-credit race conditions across every payment flow (Stripe, NowPayments webhook, NowPayments polling, saved cards).

• Fixed the sports bet auto-resolve double-payout issue.

• PG card games now use a secure cryptographic random generator instead of the predictable JavaScript default.

• Fixed the Aviator cash-out race condition that could let players cash out after the crash point.

• Fixed race conditions in chat tips, loyalty store redemptions, daily spin, and daily challenge claims.

• Session cache no longer stays valid for 5 minutes after a password change.

• Admin role assignment is now whitelisted — admins can no longer grant themselves or others arbitrary roles.

• Rate limiting added to wallet callbacks, the withdrawal endpoint, crypto prediction bets, and public chat endpoints.

• Six in-memory maps that were leaking indefinitely now have cleanup intervals.

• CSRF tokens are now consumed on validation instead of being reusable for the full hour TTL.

• Gamble round limits (Pragmatic Play, Greentube, CreateJS) all capped at 10.

• The referral endpoint no longer exposes player personal information.

• Prevented password hash and token leakage through broad user queries.

• …and around 30 more medium and low severity fixes covering XSS hardening, LIKE injection, encryption warnings, numeric parser strictness, WebSocket shutdown, and more.

💰 Bonuses, Cashback, VIP & Challenges

• Centralised bonus engine — wagering tracking across every game type, automatic expiry, withdrawal blocking with a clear message when an active bonus is not yet cleared, and an automatic welcome bonus on the first deposit.

• Centralised cashback — now works across all game types (slots, table, Aviator, crypto prediction, sports, and provider games). Rates pulled from VIP level settings with a daily cap per user and real-time balance notifications.

• VIP automation — levels are now read from the database, inactive players are auto-downgraded, and tier changes are delivered via WebSocket.

• Daily challenges — expanded from 4 to 8 types with 4 random challenges per user per day and targets that scale with VIP level.

• 
  

• 

🎰 Games & UI

• 6 new AM poker games — Deuces Wild, Fruit Poker, Tens or Better, and All American Poker. Each with its own server-side logic and paytable.

• V-Games free spins system for 4 bonus titles (BikiniParadise, QueenOfBounty, SongKranParty, TreasuresOfAztec) with scatter detection, re-trigger during free spins, and a buy-feature endpoint.

• Premium SVG icon system — emojis replaced across the platform with 35+ gradient-background icon variants.

• Per-user dynamic language — 36 places across the platform that were hardcoded to English or Arabic now correctly use each user's preferred language.

Powerful Admin Dashboard

A complete control panel to manage the entire platform, fully redesigned in v1.3 with a glassmorphism UI, gradient sidebars, and smooth animations:

• User management, KYC verification, and role management (with whitelisted role assignment)

• Financial operations, deposits, withdrawals, and manual balance adjustments

• Game settings with live per-game math controls and quick-action toggles

• Promotions, bonus codes, and VIP configuration

• 12 new stat cards, 7-day performance charts, and Top 5 games/winners tracking

• Live notification centre — real-time bell for withdrawals, support tickets, and KYC reviews

• System health monitor — real-time API status displayed in header and sidebar

• Support tickets, FAQ management, and live chat moderation

• Full site configuration: branding uploads (favicon, logos, icons with automatic WebP conversion), maintenance mode, 2 design templates, and content management (About, FAQ, Terms, Privacy)

•