Hardening (Agent mode): Agent URLs are now enforced as localhost-only in the setup wizard, gateway settings, Blocks availability, and runtime client, closing an avoidable server-side request surface before WordPress.org review.
Fix (remote node setup): WordPress’s wp_safe_remote_* only allows a short list of ports and silently blocks Monero RPC ports like 18081 (mainnet) and 38089 (stagenet), so pointing the plugin at a remote node failed until you hand-added an http_allowed_safe_ports filter. The plugin now whitelists the ports of your configured node(s) automatically (and only those; the safe-HTTP SSRF guard still protects every other host and port). Thanks to the tester who reported this. No settings change.
1.1.1
Fix (payment detection): the per-output scan loop wrapped ownership and amount/commitment decoding in one catch, so an error while decoding an output that IS yours (e.g. a pruned node, a malformed blob) was indistinguishable from “not yours” and could report a real payment as unpaid. Ownership and decoding are now separated: an undecodable but owned output fails closed and is surfaced (found-but-unverified), never silently missed. Hardening only; no settings or data change.
1.1.0
Non-custodial refunds (claim-link). Refund an order and the buyer gets a link to enter a Monero receive address (a tx never reveals the sender); you pay it by hand and mark it sent. Configurable link expiry with one-click reissue, address and network validation, and a reopen on a later refund so additional money is never stranded.
Monero payments report and CSV export under WooCommerce (owed, received, overpaid, confirmations, state, refund status), spreadsheet-formula-injection safe.
Resilient multi-node. Comma-separated nodes now genuinely fail over, and the block height is cross-checked across them (the lowest is used), so a lagging node can only delay a payment, never confirm it early.
Critical fix: the order-completion and proof paths used a non-existent WordPress function for their lock; replaced with a real atomic mutex. Also: a watch order is no longer created in an unscannable state when the node is briefly unreachable (the checkout fails cleanly so the buyer retries), a wrong-network refund address is rejected, and a mempool double-spend is never credited.
Tested PHP 7.4, 8.1 and 8.3 in CI.
1.0.1
Security: burning-bug defence. The no-server scanner now deduplicates payments by the one-time output key, not by the transaction id. Two outputs that share a one-time key (a 2018-style burn, even across different transactions) are at most one spendable output, so they can never credit an order twice.
Requires both GMP and BCMath. The pure-PHP verifier needs the BCMath extension (for base58) in addition to GMP (for the money math). The gateway now hides itself, and the settings warn, on a host missing either one, instead of failing after a buyer paid.
Hardened the settlement math to be fully order-independent (a duplicate that disagrees on lock status can never change the verdict by row order).
1.0.0
First stable release. The no-server (pure-PHP) and agent modes are both production-tested with an adversarial test suite (order-independence, dedup, byzantine duplicates, false-paid hunting).
No-server mode now sums multiple payments. A buyer who pays in installments, or sends a small test transaction then the rest, now completes automatically once the total reaches the price, matching the agent mode. Previously the WP-native scanner tracked only the first transaction.
Funds are never stranded. A watch-mode order that received a partial payment is flagged and kept open (never auto-cancelled at expiry) and completes on a top-up.
Hardened the settlement math to be independent of the order the node returns transactions in, so a duplicate or out-of-order response can never over- or under-credit an order.
0.1.8 (beta)
Clearer network indicator. The settings now show which network you are on (mainnet, stagenet or testnet) as a badge, and the wizard and address field explain that the network follows your address; there is no separate toggle. To go live, swap the address, view key and node to your mainnet ones.
0.1.7 (beta)
Privacy: Monero orders no longer store the buyer’s IP address or user-agent. WooCommerce records both on every order; since Monero is irreversible (no chargebacks), there is no dispute reason to keep them, so the plugin strips them from its orders.
The order’s confirmation count now updates while the payment is maturing. The admin shows progress (“received, N confirmations”) before the order settles, not just the final value. (The buyer’s checkout page already updated live.)
0.1.6 (beta)
No-server modes: accept Monero with no external agent. The plugin can now verify payments in pure PHP (vendored Monero crypto: ed25519, Keccak, base58), in two new modes: Auto-detect (a view-only watch over your address and node) and “I’ve paid” (the buyer pastes a transaction ID, verified on-chain). The advanced Agent mode is still there. The no-server modes need the GMP and BCMath PHP extensions (most hosts have both, or can enable them).
Mode-aware setup wizard with a live “Check setup” that confirms the node is reachable, the network matches your address, and your view key actually belongs to the address before you go live.
Pricing your way. Fixed-rate fallback when a feed is down, and you can point at your own price-source URL (JSON) instead of CoinGecko. The custom URL is fetched with SSRF protection.
Fix: the setup wizard (and the post-activation redirect) could return “Sorry, you are not allowed to access this page.” The hidden admin page is now registered so direct access works.
Fix: the “Check setup” and “Test connection” buttons returned HTTP 400. Their admin-ajax handlers are now registered correctly.
WordPress.org readiness: all inline scripts moved into enqueued asset files, ABSPATH guards on bundled files, translation template (.pot), and an “External services” privacy disclosure in the readme.
Refreshed the bundled checkout widget to the latest build.
0.1.5 (beta)
Pairs with the xmr-pay 0.4.0-beta agent (payment-correctness and reliability release). No store reconfiguration needed.
Funds are never orphaned on expiry. A partially-paid order is no longer auto-cancelled when its window lapses. The plugin asks the agent, keeps it on hold, and shows a “your funds are safe, contact us” message with the QR hidden.
Overpayment is surfaced. When a buyer overpays, the exact excess is recorded on the order (meta and note) and shown in the admin payment meta box.
Reconcile safety net. A 5-minute cron re-polls the agent for on-hold orders and completes (or flags) any the webhook missed, covering webhook outages and node catch-up.
Sync-status on the checkout. When the agent’s node is catching up, the payment page shows “node catching up…” instead of a silent “unpaid”.
Settings now note that underpayment tolerance, confirmations and expiry are configured agent-side (XMR_TOLERANCE_XMR, XMR_MIN_CONFIRMATIONS, XMR_EXPIRY_HOURS).
0.1.4 (beta)
Guided setup wizard: a step-by-step onboarding (welcome, connect agent, webhook, pricing, go live) that mirrors the npx xmr-pay agent flow, so the three values the agent prints (Agent URL, token, webhook secret) land in the right places without hunting through the full settings form. Live “Test connection” gates the step; the webhook URL is shown with a copy button. Opens automatically on activation; reachable any time from the plugins list (“Setup wizard”) or the admin notice. The full settings page is unchanged for fine-tuning.
0.1.3 (beta)
Cryptographic receipts: once an order is paid, the order-received page shows a “Download receipt” (a merchant-signed receipt) plus a one-click link to a bundled, offline, dependency-free verifier. Anyone can verify it forever, no third party. The signed receipt is also stored on the order.
New “Redirect after payment (URL)” setting: send the buyer to a custom page (a thank-you, a digital download, etc.) the moment the payment confirms. Supports {order_id} and {order_key} placeholders.
test_amount override is now honoured only when the agent is on a confirmed test network (stagenet or testnet); it can never silently fix the price on a live store.
0.1.2 (beta)
Add a “Payment box theme” setting (light or dark) so the QR and payment box match your store theme instead of always rendering light.
0.1.1 (beta)
Fix: the “open the payment page” link in the order email pointed at the order-pay page, which redirects for on-hold orders. It now links to the order-received page that renders the QR and live status.
0.1.0 (beta)
First public beta. Gateway (classic and Blocks), HPOS support, XMR-native and CoinGecko/fixed pricing, live on-chain progress and top-up, signed HMAC webhooks, exact piconero math, “Test connection”, order payment meta box, debug logging.
