WC Moneris Payment Gateway Pro

Changelog

2026.08.29 – version 4.9.20

• Fix – Refunds attempted late in the day no longer fail. A full same day refund is sent to Moneris as a Purchase Correction, which is cheaper and leaves a single entry on the cardholder statement, but Moneris only accepts one while the settlement batch holding the original payment is still open. The check compared the time the order was placed against the batch closing time instead of the current time, so an order paid in the morning and refunded late the same evening still attempted a Purchase Correction against a batch that had already closed, and the refund failed. Refunds after the batch closes are now sent as ordinary Refunds, which always work.
• Fix – The plugin no longer changes the site wide timezone while taking a payment or issuing a refund. Five places set the timezone to Eastern and never set it back, so every later date calculation in that same request used Eastern instead of your own timezone. This could shift order dates recorded by WooCommerce and by any plugin loaded after this one. Moneris reports its transaction times on its own Eastern clock and the batch closes on that clock for every Canadian merchant regardless of province, so those times are now read as Eastern explicitly rather than by changing a global setting. Merchants whose batch closes on a different schedule can adjust it with the wpheka_gateway_moneris_pro_batch_timezone filter.
• Fix – A payment time that Moneris reports without a date is no longer treated as today. Moneris occasionally returns the transaction date as an empty value, which left only a time such as 14:21:01, and that was interpreted as the current day. A months old payment could therefore look like a same day one and a Purchase Correction would be attempted on it. Such a value is now rejected and the refund proceeds as an ordinary Refund.
• Fix – Address verification: a postal code only match is no longer treated as a full address match. Moneris returns a specific result meaning the postal code matched but the street address did not, and the plugin was accepting it as though both had matched. It is now handled by the postal code match rule you have configured. If you have address verification enabled and set to require a full match, transactions returning this result will now be handled according to that setting rather than being accepted automatically.

2026.08.24 – version 4.9.19

• Fix – 3D Secure: a challenge result that belongs to an earlier authentication attempt is now detected instead of being treated as a failed card. The result your browser posts back after a challenge names the authentication it belongs to, and Moneris resolves it against that authentication rather than the one just started, so a challenge page served from a browser or CDN cache produced a "not authenticated" result for a perfectly good card. One merchant lost three attempts on a single order this way, including one attempt made with a different card. The customer now sees a message explaining the security check expired, the stored authentication state is cleared so the next attempt starts fresh, and the log records both transaction identifiers. Note – the underlying trigger is usually a cache serving the challenge page; if you use a CDN, make sure checkout and any URL containing wc-api are excluded from caching.
• Fix – The 3D Secure challenge page now sends no-store cache headers, including CDN-Cache-Control, so neither a browser nor a CDN configured to cache everything can serve a stale copy of a challenge that belongs to one specific authentication attempt.
• Fix – The card authentication value (CAVV) is no longer written in full to the debug log. It is single-use authentication proof with no diagnostic value, and logs are routinely attached to support tickets.
• Fix – On the block checkout, the card number, expiry and security code labels are now correctly associated with their inputs, so screen readers announce the right field and clicking a label focuses it.
• Enhancement – 3D Secure logging now records which authentication Moneris answered about, along with the transaction status reason and the challenge completion indicator. A failed challenge can now be diagnosed from the log alone, without asking for a second reproduction.
• Fix – Security: card numbers are no longer written to the debug log. Four 3D Secure log entries recorded the full number, and the raw request log recorded the whole message including it. Both now show only the last four digits, and the raw request additionally has the card verification value redacted. The data sent to Moneris is unchanged.
• Fix – Security: the card verification value (CVD) is no longer written to the log at all. It was recorded by a separate log call that the existing masking never covered. A verification value must not be retained after a payment is authorized, and a log file is retention.
• Fix – Privacy: the customer data log entry no longer contains the billing address, email address, phone number and IP address. It now records only which fields were present.
• Fix – Two fatal errors in the 3D Secure flow when WordPress had no active customer session. One check read "no session OR no started session" and then used the session anyway, so a missing session crashed the payment instead of being handled. The other wrote to the session on the issuer's server-to-server callback, where a session frequently does not exist.
• Fix – The 3D Secure browser details sent for authentication (user agent, accept header, client IP) were sent with WordPress's added escaping still in place, so a browser whose details contain a quotation mark had a backslash inserted before the value reached Moneris.
• Fix – Performance: rewrite rules were rebuilt on every single page load, front-end and admin, along with two database writes each time. This happened because the endpoint registration marked a flush as needed on every request. Flushing now happens once per plugin version, which is what was intended.
• Fix – The order lock could call itself without limit when a competing request released the lock at the exact moment ours looked for it. Under repeated contention on the same order that could exhaust the stack during a payment. It now retries once, as the code always intended.
• Fix – A licensing server error no longer deactivates the license locally. An error response sent with an HTTP 200 status passed the existing "empty response" guard, and the absent activation flag was then read as "not activated", which hid the payment method at checkout. Deactivation now requires the server to state the activation status explicitly.
• Fix – The licensing deactivation response is no longer written to the log in full, as it can contain the license key. A short summary is recorded instead.
• Fix – One diagnostic message went to the PHP error log rather than the WooCommerce log where the rest of the 3D Secure trail is recorded.
• Fix – Security: the 3D Secure challenge page now verifies that the visitor owns the order before doing anything with it. The order number appears in that page's address, and previously supplying any order number was enough, which meant a visitor could drive another customer's authentication or, for an order already paid, be sent to its confirmation page and read it. The checkout now includes the order key in that address and the page requires it, with a customer's existing session accepted as an alternative so anyone already part-way through a payment is unaffected.
• Fix – Security: the 3D Secure callback from the card issuer no longer acts on an order named in its address without evidence that the request belongs to that order. The evidence is a single-purpose token issued for that one authentication, deliberately not the order's own key, which would otherwise have been sent onward to the card issuer's systems. Previously naming another customer's order was enough to clear their in-flight authentication and interrupt their payment.
• Fix – A duplicate request can no longer produce two authorizations for one order. Completing a 3D Secure payment happens on an ordinary page load, so a reload, a browser prefetch or a repeated redirect from the card issuer could start it twice before the first finished. Completion is now serialised per order and re-checks whether the order was paid in the meantime.
• Fix – Payment rate limiting can no longer be bypassed by forging the client address. The existing per-visitor limit reads the forwarded-address headers, which the caller supplies, so rotating them gave a fresh allowance each time. A second, much higher limit now applies to the actual connection address, which cannot be forged. The ceiling is deliberately high so stores behind a CDN, where many shoppers share one connection address, are unaffected, and it can be raised with the wpheka_moneris_pro_peer_rate_limit filter.
• Fix – A third instance of the session crash described above, in the 3D Secure challenge page itself.

2026.08.17 – version 4.9.18

• Fix – Card expiry entered without a separator (for example "0831" instead of "08/31") no longer fails. Checkout plugins such as CheckoutWC post the raw digits, which previously produced a "Missing expdate" error from Moneris when 3D Secure was enabled, and a malformed expiry date on the standard payment path. Expiry parsing is now shared by the 3D Secure, standard payment and saved-card paths, and accepts MM/YY, MMYY, MM/YYYY, MMYYYY, M/YY, dash, dot and space separators. An expiry that cannot be read now shows a clear checkout message instead of a gateway error.
• Fix – CVD (card verification digits) checking never actually ran. Moneris returns the CVD result as two characters – an indicator digit followed by the result letter, for example "1M" meaning "matched" – and the plugin compared the whole value against single letters, so no CVD result ever matched. Every transaction fell through to an "accept" outcome regardless of the CVD rules you had configured. If you have CVD rules set to Reject or Hold, they will now take effect for the first time, so expect them to start acting on genuine mismatches.
• Fix – AVS and CVD rules no longer act on a result Moneris did not provide. Moneris returns a blank AVS result when it performs no address check; this was being treated as "could not be verified" rather than "not checked", which could hold or reject a perfectly good order on stores whose policy is not Accept.
• Fix – AVS and CVD rules no longer accept a transaction when Moneris returns a result code the plugin does not recognize. Previously any unrecognized code bypassed the configured rule entirely. Unrecognized codes now follow your "could not be verified" setting and are written to the log. Note – if you have set AVS or CVD "could not be verified" to Reject or Hold, orders that were previously accepted because of these bugs will now follow that setting. Set it to Accept to keep the old behaviour.
• Fix – 3D Secure flow type is now recorded for challenge authentications completed through the fallback path, where it was previously omitted.
• Enhancement – New filter `wpheka_moneris_pro_should_use_3ds` lets a fraud-scoring integration decide, per order, whether 3D Secure is attempted. The callback signature is `(bool $brand_eligible, WC_Order $order, string|null $card_brand)` – note the order is the SECOND argument, not the first – and it can only reduce the set of 3D Secure transactions, never extend it beyond the card brands Moneris supports. Skipped orders get an order note. The challenge preference is still not sent, so Moneris and the issuing bank continue to decide between a frictionless flow and a customer challenge.
• Enhancement – 3D Secure results are now saved on the order so other plugins can read them – authentication status, protocol version, transaction status, ECI, flow type (frictionless, challenge or attempted), liability shift result and the 3DS Server Transaction ID. The CAVV is deliberately not stored, as it is a single-use value.

2026.07.25 – version 4.9.17

• Fix – International 3D Secure authentication no longer fails for shipping/billing addresses whose province uses a country-prefixed code (e.g. Japan "JP38"). Province values are now normalized to the ISO 3166-2 subdivision code Moneris requires, so international orders no longer return "Invalid Formatted Message" / failed_mandatory. Domestic Canada/US orders are unaffected.
• Fix – Moneris Checkout (MCO) preload now sends the same normalized ISO 3166-2 province code (2-character limit per the Moneris Checkout spec) in billing and shipping details, preventing the same class of failure on the hosted checkout.

2026.06.04 – version 4.9.16

• Fix – 3DS transactions where the issuer returns "authentication attempted" (trans_status A / ECI 6) now route to a plain purchase request with crypt_type=6 per Moneris's documented routing rule. Previously these transactions were sent through cavv_purchase with a placeholder CAVV, which strict issuer-side CAVV validators may reject.
• Fix – "Deactivate License Key" button now actually releases the server-side activation slot on the licensing server. Previously a stale-cache guard caused the deactivation request to be silently skipped, and an unconditional re-activation on every activation-tab visit re-claimed the slot immediately. Both have been addressed.
• Fix – PHP notice "_load_textdomain_just_in_time was called incorrectly" no longer appears in the debug log. License Manager is now instantiated on `init` instead of `plugins_loaded` so its constructor's translation lookups run after WordPress has loaded textdomains.
• Fix – Success and error notices on the License Activation page are now actually rendered (previously stored in the settings transient but never displayed because the page lives under a custom top-level menu rather than WordPress's built-in Settings menu).
• Fix – "Update available" notice no longer lingers after a successful plugin update, requiring customers to click Update a second time to clear it. WordPress's same-request transient rebuild was re-injecting a stale in-memory version constant; the update_check callback is now removed during the rebuild window.
• Enhancement – Cardholder mobile phone number from the WooCommerce billing address is now included on the 3DS Authentication request. Per Moneris documentation, missing phone numbers increase the risk of issuer rejection.
• Enhancement – The Moneris API library's purchase() and authorize() methods now accept an optional crypt_type override, enabling the 3DS attempted-authentication path above without duplicating Gateway logic.
• Enhancement – Detailed WooCommerce log entries ("wpheka-moneris-license" source) for every license deactivation attempt — raw server response plus parsed result — for easier diagnosis of future activation/deactivation issues.
• Removed – Automatic license re-activation when visiting the License Activation tab. The previous behaviour fought user-initiated deactivation. Customers can re-activate by re-entering their key on the activation tab as needed.

2026.06.03 – version 4.9.15

• Fix – 3DS-authenticated transactions now send the correct e-commerce indicator (derived from the issuer-returned ECI) instead of a hardcoded "SSL-enabled merchant" value. Resolves recurring response-code 487 declines from strict card issuers where the CAVV cryptogram was being rejected due to a data inconsistency in the cavv_purchase / cavv_preauth request.
• Add – Raw request/response logging at debug level for 3DS Authentication, CAVV Purchase, CAVV Pre-Authorization, Vault card tokenization (res_add_cc), and the 3DS challenge-completion AJAX endpoint. Substantially improves diagnosability of future 3DS and saved-card issues.
• Update – Bumped "WC tested up to" to 10.8.1.

2026.05.23 – version 4.9.14

• Add – "3D Secure Eligible Cards" setting under the 3D Secure toggle that restricts 3DS to selected card brands (Visa / MasterCard / American Express). Cards of other brands are processed as a standard Purchase.
• Fix – American Express cards no longer fail with "Service unavailable" (Code 900) at 3DS Card Lookup on merchant accounts without Amex OFI. Amex is unchecked by default in the new setting and bypasses 3DS unless explicitly enabled.

2026.05.14 – version 4.9.13

• Fix – Duplicate charges prevented when customers double-click Place Order or refresh checkout while payment is still processing (atomic per-order in-flight lock)
• Fix – Duplicate payment detection now reads directly from order meta tables (HPOS-aware), avoiding stale in-memory caches that allowed concurrent attempts to slip through
• Enhancement – Per-order and per-IP attempt counters are incremented only after a confirmed Moneris-side failure, so legitimate retries blocked by the in-flight guard no longer consume the customer's attempt budget

2026.04.25 – version 4.9.12

• Fix – 3DS session data now cleared immediately on CAVV purchase failure, preventing stale authentication data from leaking into subsequent orders
• Fix – Moneris "null" string response code and duplicate order ID responses no longer treated as approved transactions
• Fix – Orders now correctly set to Failed (instead of remaining in Pending Payment) when CAVV purchase is declined after 3DS challenge
• Fix – Customer redirected to checkout with error message on CAVV decline instead of the now-failed order pay page
• Fix – "Save to account" checkbox no longer shown to guest users (checkbox was visible but silently ignored server-side)

2026.04.11 – version 4.9.11

• Fix – 3DS CAVV Lookup no longer corrupts standard base64 CRes from production bank ACS; replaces sanitize_text_field() with a whitelist-only sanitizer preserving valid base64/base64url characters
• Fix – Empty CAVV after CAVV Lookup now redirects to payment page with an error notice instead of silently looping the 3DS challenge
• Add – Raw CAVV Lookup response data logged at debug level for easier diagnosis of future 3DS failures

2026.03.27 – version 4.9.10

• Fix – Daily license sync now correctly loads license data in cron context, preventing the payment gateway from being incorrectly disabled overnight due to a false "no API key" failure

2026.03.24 – version 4.9.9

• Fix – License activation notice now links to correct admin page
• Fix – PHP notice _load_textdomain_just_in_time no longer appears in debug log
• Add – Daily license sync: gateway is automatically disabled when subscription expires
• Add – Silent re-activation: license re-activates automatically after subscription renewal
• Add – Plugin icon and banners now display in WordPress Updates and plugin info popup

2026.03.18 – version 4.9.8

• Enhancement – Added "Authorize Order Status" setting to allow merchants to choose between "Processing" or "On Hold" when a payment is authorized in Authorize mode
• Fix – License activation notice now redirects to correct admin page (admin.php instead of options-general.php)

2026.02.25 – version 4.9.7

• Fix – Auto-capture now works correctly for AUTHORIZE orders flagged as on-hold by AVS/CVD fraud detection when merchant manually approves the order

2026.02.21 – version 4.9.6

• Enhancement – AUTHORIZE mode orders now set to "processing" immediately (instead of "on-hold"), enabling third-party fulfillment integrations
• Add – Auto-capture: authorized payments are automatically captured when order status changes to "completed"
• Add – 3DS e-fraud validation support for both purchase and authorize mode transactions
• Fix – Browser fingerprint data (user agent, screen dimensions, language, timezone) now correctly passed to 3DS in WooCommerce blocks checkout
• Fix – browser_java_enabled boolean value now correctly normalized to "true"/"false" string for Moneris API in blocks checkout

2026.01.27 – version 4.9.5

• Fix – Critical: Prevent duplicate charges when AVS/CVD rejects after Moneris approval
• Fix – Save transaction identifiers before AVS/CVD evaluation to prevent empty refund attempts
• Fix – Replace automatic refund/reversal logic with manual review workflow for safer fraud handling
• Fix – Add duplicate payment prevention check at payment processing entry point
• Fix – Implement transaction-type-specific identifier handling for AUTHORIZE vs CHARGE types
• Fix – Save capture metadata early for CHARGE type to enable merchant refunds
• Enhancement – Add clear fraud alerts in order notes with specific AVS/CVD failure reasons
• Enhancement – Set proper order status for AUTHORIZE transactions based on fraud check results
• Enhancement – Orders no longer marked as "failed" after Moneris approval, preventing customer retries

2025.12.01 – version 4.9.4

• Enhancement – Updated dynamic_descriptor field validation to 20 character maximum limit
• Enhancement – Added client-side and server-side validation for dynamic_descriptor field with maxlength attribute
• Enhancement – Improved character filtering for dynamic_descriptor to remove forbidden special characters: < > $ % = ? ^ { } [ ] /
• Fix – Fixed undefined array key "fax" warning in mpgClasses.php with proper isset() checks
• Fix – Fixed TypeError in secure_log() method by properly handling mpgResponse objects as array context
• Fix – Improved error handling for WooCommerce order item methods with proper null checks and type validation
• Fix – Enhanced billing_details conditional inclusion following shipping_details pattern for better data structure efficiency

2025.11.02 – version 4.9.3

• Enhancement – Major code quality and security improvements implemented
• Add – Configurable maximum payment attempts setting (0-10, default: 3)
• Add – IP-based rate limiting with enable/disable toggle (10 attempts per hour per IP)
• Add – Enhanced input validation with Luhn algorithm for credit card verification
• Enhancement – Improved error handling and logging with request tracking
• Enhancement – Enhanced secure logging with masked sensitive data and context information
• Enhancement – Added type declarations to key methods for better code quality
• Enhancement – Modernized PHP patterns using null coalescing operators
• Fix – Removed unused code and imports for cleaner codebase
• Fix – Fixed method compatibility issues and diagnostic errors
• Fix – Enhanced method documentation with comprehensive security explanations
• Security – Multi-layer rate limiting (IP + order-based) to prevent abuse
• Security – Enhanced input sanitization to prevent XSS attacks
• Security – Improved client IP detection with proxy support
• Misc – Code refactored following modern PHP best practices

2025.07.31 – version 4.9.2

• Fix – Fixed AVS & CVD data passing issue even when it is disabled
• Misc – Added support for WooCommerce 10.0.4

2025.07.29 – version 4.9.1

• Fix – Fixed critical SQL injection vulnerability
• Fix – Added CSRF protection with nonce verification
• Fix – Implemented comprehensive input sanitization
• Fix – Fixed variable variables security issue
• Fix – Added authentication checks
• Fix – Fixed missing text domains
• Fix – Corrected improper use of translation functions
• Fix – Standardized text domain usage
• Fix – Improved WordPress coding standards compliance
• Fix – Enhanced error handling and user feedback

2025.06.11 – version 4.9

• Fix – Duplicate order id issue fix improved for production environment.
• Fix – Moneris checkout preauth refund issue fixed.
• Add – New `wpheka_moneris_order_number` filter added to moneris direct gateway to override order id.
• Add – New `wpheka_moneris_checkout_order_number` filter added to moneris checkout gateway to override order id.
• Misc – Added support for WooCommerce 9.9.3

2025.05.30 – version 4.8

• Add – Moneris Checkout authorization capture and reverse added in order details page actions.
• Add – Moneris Checkout automatically capture authorization order when order status changes to completed.

2025.05.29 – version 4.7

• Enhancement – Moneris Checkout gateway cart empty logic improved.
• Add – Add new `wpheka_virtual_downloadable_order_status` filter to moneris direct gateway to update order status if all items are virtual and downloadable.

2025.05.26 – version 4.6

• Enhancement – Moneris Checkout process improved.
• Enhancement – Moneris classic API gateway process improved.
• Enhancement – Moneris checkout added for WooCommerce block-based checkout.
• Enhancement – AVS fields removed from checkout page.
• Misc – Added support for WooCommerce 9.8.5

2025.05.08 – version 4.5

• Fix – WooCommerce block checkout credit card expiry field mobile keyboard issue fixed.
• Misc – Added support for WooCommerce 9.8.4

2025.05.06 – version 4.4

• Enhancement – Moneris Checkout cron improved.
• Enhancement – Moneris Checkout pay for order improved.
• Misc – Added support for WooCommerce 9.8.3

2025.02.02 – version 4.3

• Enhancement – Moneris Checkout gateway improved.

2025.01.04 – version 4.2

• Fix – CVD & AVS Checkings issues fixed.
• Enhancement – Moneris Checkout user interruptions callbacks improved.
• Misc – Added support for WooCommerce 9.5.1

2024.12.14 – version 4.1

• Enhancement – Moneris API updated to 1.0.31
• Enhancement – CVD & AVS Checkings improved.
• Misc – Added support for WooCommerce 9.4.3

2024.11.30 – version 4.0

• Fix – Checkout page save card issue fixed.

2024.07.18 – version 3.9

• Enhancement – Moneris checkout v2 library added.

2024.06.11 – version 3.8

• Fix – HPOS refund issue fixed.

2024.06.11 – version 3.7

• Enhancement – WooCommerce checkout blocks support added.
• Enhancement – High-Performance Order Storage (HPOS) support added.

2023.12.19 – version 3.6

• Misc – Added support for WooCommerce 8.4.0
• Fix – License settings page layout issue fixed.

2023.12.07 – version 3.5

• Misc – Added support for WooCommerce 8.3.1

2022.11.10 – version 3.4

• Fix – The issue of repeated payments upon entering wrong credit card information has been resolved in the "Authorize" transaction type.

2022.08.23 – version 3.3

• Fix – Admin settings error display issue fixed.
• Enhancement – Moneris MCO checkout payment improved.

2022.06.20 – version 3.2

• Fix – Card tokenization issue fixed.
• Fix – License Api error display issue fixed.
• Enhancement – Moneris MCO checkout refund info added.

2022.02.11 – version 3.1

• Fix – License settings api_key issue fixed.
• Fix – License settings default message issue fixed.
• Fix – License setings product id issue fixed.

2022.02.10 – version 3.0

• Fix – License settings page layout issue fixed.
• Fix – Php warnings on license settings page fixed.
• Enhancement – Moneris API updated to 1.0.22

2021.03.05 – version 2.9

• Dev – Moneris checkout failed message filter `wpheka_moneris_checkout_failed_message` added.
• Fix – MCO php notices fixed.

2021.03.04 – version 2.8

• Enhancement – Moneris Checkout payment method added.

2020.12.11 – version 2.7

• Fix – CVD issue fixed.

2020.12.04 – version 2.6

• Enhancement – Moneris Api updated to 1.0.20

2020.09.30 – version 2.5

• Fix – Default order status issue fixed.

2020.08.06 – version 2.4

• Misc – Add support for WooCommerce 4.1
• Feature – Add multi-currency support to allow USD and CAD transactions to be processed using different Moneris accounts
• Feature – Sequential Order Numbers compatibility added

2020.07.23 – version 2.3

• Fix – Fix transactions failing with trailing slash

2020.07.22 – version 2.2

• Fix – Multiple domain license fix added

2020.07.21 – version 2.1

• Fix – Credit card form fix added

2020.06.20 – version 2.0

• Tweak – Moneris API updated

2020.04.23 – version 1.0

• First Release