Pay50 for WooCommerce

Changelog

1.2.9

• Security: the Live/Test Base URL settings are now restricted to https:// URLs on the pay50.com domain. These settings are also used to build the checkoutlibrary script/style URLs on the 3DS iframe page, so an unrestricted value could have been used to load a remote script/style from any host.

1.2.8

• New: post-purchase upsell 3DS challenges are now also reconciled via webhook, not just the return URL — a webhook notification for a pending upsell previously had no dedicated handling.

1.2.7

• Fix: retrying a payment on the same order with a different card (e.g. via the order-pay “Pay” link after a failed order) reused the same gateway ORDER_ID, so a slow/abandoned first attempt’s callback could be mistaken for the current attempt’s result — occasionally showing “successful” for a payment that actually failed. Each retry now gets a uniquified ORDER_ID, and callbacks are checked against the order’s current attempt before being trusted.

1.2.6

• Fix: the 3DS iframe capture page registered the gateway’s own script/style assets without a version, which could let browsers keep serving a stale cached copy. Both now carry an explicit version.

1.2.5

• Changed: the upsell 3DS challenge no longer runs in an embedded popup iframe — accepting an upsell that needs authentication now closes the popup and uses the same full-page redirect/iframe pages (and the same “3DS Capture Display” setting) as the main checkout. Fixes the return landing somewhere other than the thank-you page.

1.2.4

• New: automatic Status Enquiry safety net for both the main checkout and the upsell funnel. A short cascade of background checks now runs after every return/webhook (success or failure) and after every upsell 3DS challenge starts, so orders reconcile even without the customer clicking anything. Already-paid orders only get a confirmation check (a mismatch is flagged for review, never auto-reversed).

1.2.3

• New: “Already paid? Check again” button in the upsell 3DS challenge popup — if the challenge iframe loses its connection (e.g. switching to mobile view mid-payment can drop it) before reporting back, this manually re-queries Pay50 for the real status and finalizes or rolls back the pending upsell accordingly.

1.2.2

• Removed: the upsell popup’s “Custom code” (Custom HTML/CSS/JS) fields have been removed — WordPress.org no longer permits plugins to let users save and echo back arbitrary custom code. The existing structured appearance controls (colors, background, buttons, layout) are unaffected.
• Fix: several inline <style>/<script> blocks (admin funnel metrics page, order “Re-check Status” button, 3DS redirect pages, upsell 3DS result page) are now registered/enqueued through the standard WordPress script/style APIs instead of being echoed directly as HTML.
• Fix: a test-mode-only diagnostic log in the gateway return handler could log a gateway-return field before it was sanitized. It’s now sanitized first, matching the rest of the handler.
• Fix: the “Test Mode active” / “Live Mode active” gateway admin notice no longer appears on every wp-admin screen — it’s now limited to the WooCommerce settings, order, and Plugins screens where it’s actionable.
• Fix: removed leftover placeholder text in the Terms of Service / Privacy Policy lines of the External Services disclosure.

1.2.1

• Fix: upsell 3DS challenge return verification incorrectly compared two TXN_IDs that Pay50 never intends to match (enrollment-stage vs. capture-stage), causing “Payment verification failed” even when the card was genuinely charged. Verification now matches the main checkout flow (HASH + ORDER_ID only).
• Fix: the 3DS challenge iframe on the upsell popup now replaces the popup’s normal content instead of appending below it, so the popup no longer grows/overflows while the challenge is active.

1.2.0

• Fix: post-purchase upsell (card-on-file) charges that come back “Enrolled” (3DS challenge required) now complete the challenge through the same Payment Capture endpoint used by regular checkout, instead of failing outright. The challenge runs inline, in an iframe, inside the thank-you-page upsell popup.

1.1.0

• New: optional iframe-based 3DS capture display (in addition to the default full-page redirect) — requires emailing your domain to Pay50 support for whitelisting first.
• New: send additional conditional-mandatory fields recommended by the updated Pay50 spec — BROWSER_ACCEPT_LANGUAGE, OS_TYPE, OS_VERSION, DEVICE_MODEL, and SOURCE_URL — on both checkout and card-on-file upsell charges, to improve authorization success rates.

1.0.0

• Initial public release.
• Frictionless (2DS) and 3-D Secure (3DS) card payments via the Pay50 gateway.
• SHA-512 signing of every API request and verification of every response/webhook.
• Client- and server-side card validation (Luhn, expiry, CVV) and live card-brand detection.
• Card-on-file: optional save-card at checkout with token-based merchant-initiated charges.
• Post-purchase upsell funnels (rule builder + thank-you modal) charged to the saved token.
• Status enquiry and automatic pending-order reconciliation (WP-Cron or external cron).
• Optional consent, date-of-birth, and card issue-date fields. HPOS compatible.