TextMe SMS

2.0.4

• Fix: Remove global session_start() on init — prevents “Active PHP Session Detected” Site Health warning, REST API timeout (cURL error 28), and block editor load failures caused by PHP session lock blocking concurrent requests
• Fix: session_write_close() now called after every AJAX handler that reads/writes $_SESSION, releasing the server-level lock immediately
• Feat: Replace sticky tag-chip block with per-textarea “Insert Field…” dropdown; tag is inserted at cursor position and works in dynamically added custom status rows
• Feat: Switch WooCommerce order SMS from individual woocommerce_order_status_{status} hooks to universal woocommerce_order_status_changed hook — SMS now fires reliably from PayPlus, shipping plugins, REST API, HPOS, and other third-party triggers
• Feat: Add “Status Change Debug Log” toggle in WooCommerce tab; logs every order status transition and SMS send/skip reason to WooCommerce → Status → Logs (source: textme-sms)
• Fix: Deduplication lock (textme_sms_sent{status} order meta) prevents duplicate SMS if both the universal and individual hooks fire for the same transition

2.0.3

• Fix: Fatal error “Cannot use object of type WC_Meta_Data as array” when changing order status — ShipOS tracking number now correctly reads the WC_Meta_Data object value
• Fix: Extension fields added via the textme_sms_form_fields action hook now have a dedicated Save button and AJAX handler; data is saved to textme_sms_option for full backward compatibility with theme extensions

2.0.2

• Fix: WooCommerce SMS templates with v1-style tags ([first name], [last name], [order number] with spaces) were sent with unreplaced literal tags after migration — backward-compatible aliases added
• Fix: [order_status], [ship_num], and [shipping_number] tags were shown in the admin tag picker but never replaced in outgoing SMS messages
• Fix: [ship_num] and [shipping_number] now correctly read from ShipOS (wc-shipos-delivery) order meta using the actual delivery_number field
• Fix: Carriage return characters (r) from textarea form submissions were appearing as in received SMS messages
• Fix: TEXTME_SMS_VERSION constant was out of sync with plugin header version

2.0.1

Architecture

• Complete plugin rewrite with a modular, class-based architecture
• Each feature now stores its own settings separately — no more shared flat options array
• New top-level admin menu replacing the nested Settings page
• Built-in migration tool to carry all v1.x settings forward to v2.0.0 automatically
• PHP 7.4+ and WordPress 5.2+ now required

WooCommerce

• Independent customer and admin SMS toggles per order event
• Added pending payment SMS notifications (customer and admin)
• Added support for custom order statuses with individual SMS messages
• Added customer note SMS (send from the WooCommerce order note field)
• Added option to save customer phone number to address book on order

Out of Stock Notifications (new)

• Customers can subscribe to restock alerts directly from the product page
• Optional name, email, and terms & conditions fields on the subscription form
• Admin reports page with Pending and Sent tabs showing all subscribers
• Bulk SMS — notify all waiting subscribers in one click when stock returns

User Registration Coupon (new)

• Generate a unique WooCommerce coupon automatically on new user registration
• Send the coupon code to the customer via SMS
• Configurable discount type, amount, and coupon code length

Login Security (new)

• Admin OTP / 2FA — intercepts wp-login.php and requires SMS verification before granting admin access
• [textme_login_form] shortcode — custom login form with username, password, and SMS OTP step
• [textme_phone_login] shortcode — passwordless login using phone number and SMS OTP
• Configurable max OTP attempts, resend cooldown, and fallback phone meta field
• International phone number support

Balance Monitoring (new)

• Daily cron job checks your TextMe account balance
• Sends an email alert to the site admin when balance drops below a configurable threshold

Reports & Logging (new)

• API call log viewer in the admin — shows phone, message preview, status, and HTTP code
• Enable/disable logging toggle — disabled by default
• Clear all logs button
• Logs auto-pruned after 90 days (configurable)

Admin & UX

• Test SMS sending directly from the settings page with live response display
• Connection status indicator in the settings header
• Copy-on-click shortcode helper
• Fully responsive admin design

Internationalization

• Full Hebrew translation included
• All JavaScript strings localized

Security

• Session cookies hardened with Secure, HttpOnly, and SameSite=Strict flags
• Session ID regenerated after every successful OTP login to prevent session fixation
• Brute-force protection on credential login (5 attempts per 15 minutes)
• XXE vulnerability patched in legacy XML API parser
• Open redirect blocked — shortcode redirect attribute restricted to same-site URLs
• SSL verification explicitly enforced on all outbound API calls
• Generic error messages on phone lookup to prevent user enumeration
• Plugin options set to autoload=false — settings not loaded on front-end pages that don’t use them

1.0.0

• Initial release