What changed in WopCart.

Added

• Free plan via Stripe Connect

Improved

• The Bundle tab no longer shows an empty box on a store that has only one product. It says why the list is empty, offers drafts with their status, and explains that products are picked from the list rather than typed into it.
• The Releases & Deploy box explains that releases are for selling software, and shows nothing else until licensing is switched on for that product — instead of presenting webhooks, a secret and a signing key to someone selling a PDF. The GitHub section says what it saves you, and the offline verification key says who actually needs it.

Fixed

• The Seooptimierung Toolkit integration had stopped working. That plugin renamed itself from SEO-WP in version 1.7 and renamed its namespace and filters with it, so WopCart never recognised it: product and paywall schema were not added to its graph, restricted text was not guarded in its descriptions, and store system pages were not excluded from its sitemap. Both the current seooptimierung/ prefix and the old seo_wp/ one are hooked now, and either constant counts as active, so an installation that has not updated yet keeps working too.

Changed

• The plugin ships Stripe and Apple Pay. PayPal, Authorize.net, Mollie and 2Checkout are no longer part of it; they come with WopCart Direct, the add-on that lets a store charge through its own gateway accounts.
• The plan key is gone, and with it the settings section and the card that went with it. Nothing in the plugin is switched off or limited by a key any more.
• Uninstalling no longer deletes credentials or settings that belong to an add-on. It removes what this plugin created and writes the rest back.
• Payment forms offer the gateways that are actually installed. The old list named 2Checkout under a name it never registered under, so that gateway was never offered on a form.

Removed

• Removed with the plan: the filters wopcart_free_plan_gateways, wopcart_plan_api_base, wopcart_plan_endpoint and wopcart_plan_{action}_endpoint.

Changed

• The code that only ever runs on WopCart's own payment platform no longer ships with the plugin. It moved into a separate plugin that is installed only there.
• The two database tables that belonged to that code, and were created on every store without ever being used, are removed on update. A store that is the platform keeps them, and a table that still holds rows is kept and reported rather than dropped.
• The scheduled task that delivered platform events is removed from stores that are not the platform.

Added

• Extension points so a separate add-on can supply a store's own gateway credentials: filters for the Stripe secret and publishable key, a neutral question whether a store transacts with its own credentials, a filterable list of settings kept out of the autoloaded option, and hooks for integration cards, connection tests, system status rows, the privacy policy text and gateway scripts. Nothing in the plugin behaves differently because of them.
• Plugin::supports() so an add-on can check whether the installed plugin is new enough for it.
• A page for extension authors in the developer documentation, describing the seams an add-on may rely on.

Changed

• wopcart_settings_saved now also receives the settings as they were before the save, so a listener can react to what actually changed.
• Connect::is_paid_plan() is now Connect::uses_own_credentials(); the old name and the wopcart_is_paid_plan filter keep working as aliases.
• A store that is neither connected to Stripe nor holds its own key now gets a single error, and an unconnected store is told to connect under Settings → Payments instead of reading that Stripe is not configured.

Changed

• The plugin package no longer contains the drop-in updater template for merchants; it is handed out with the licensing SDK instead, because a plugin in the WordPress.org directory may not carry code that hooks WordPress's update mechanism.
• The readme was rewritten for the WordPress.org directory: a shorter description that is no longer cut off in the listing, the detail moved into the FAQ, and a section describing every external service the plugin can contact, when it is contacted and what it receives.

Fixed

• Review pagination, cart quantities and the product list of a content restriction clean their input in a form code analysis recognises. Behaviour is unchanged, except that a negative page number in a review link is treated as page 1 again.

Security

• Discount codes with a minimum order no longer make the cart calculate itself in a loop until the page fails.
• Prices, sale prices, price options, sign-up fees, currency overrides, discounts and payment form amounts can no longer be negative, and a discount can never push a line below zero.
• Order status changes are checked against the states they may come from, so a redelivered payment notification can no longer turn a refunded order back into a paid one.
• A cancelled or expired subscription stops granting its bundle products and its downloads.
• Country headers such as CF-IPCountry are only used when the store opts in with the wopcart_trusted_country_headers filter, so a visitor can no longer choose their own tax country.

Changed

• Checkout no longer refuses an order when the billing country and the country behind the visitor's address differ. Both are recorded, the difference is flagged on the order, and the strict refusal is now a setting that is off by default.
• An order whose billing country and detected country differ is marked on the order screen, in the order list and in a "Location evidence" table under the VAT report.
• A discount set to "never" on subscriptions is now refused on subscription lines instead of behaving like "first payment only".
• New "Store notification address" setting for notices about sales and refund requests; it falls back to the From address.

Fixed

• Authorize.net card fields appear at checkout again; they were being stripped from the page, so every card was refused.
• 2Checkout subscriptions end when the paid period does and say so, instead of reporting a cancellation the provider never performed, and a renewal no longer revives a cancelled subscription.
• PayPal and Authorize.net recognise the first subscription charge, so it is no longer booked as a renewal (or missed entirely after a trial).
• A second PayPal part refund of the same amount is no longer silently skipped, and changing a plan's interval or trial no longer reuses the old PayPal plan.
• Product prices copied into a manual invoice or quote are converted correctly when prices include tax, so VAT is no longer added twice.
• An order can no longer receive two invoice numbers when a webhook and a click arrive together.
• A paid proforma whose invoice number could not be issued stays repairable and can be issued from the invoice screen.
• Invoice and quote numbers and the retention period follow the store's timezone, so a document issued just after midnight is no longer numbered into the previous year.
• An invoice prefix of "Q" no longer shares its counter with quotes.
• Quote numbering keeps counting where it left off after the update.
• A receipt is only recorded as sent once it has been sent, including plan upgrade receipts, so a failed receipt is sent again.
• Renewal, trial and licence emails show their dates again, and an unlimited licence no longer reads "1 of 0".
• Importing discounts keeps the fields the file does not contain and reports rejected rows.
• The discount editor keeps products outside the first 200, keeps a scheduled code's dates, and gained description, categories and the "never" option.
• Settings: a multiple choice list can be emptied again, saving keeps the tab you were on, and an unknown tab falls back to General.
• The content restriction box keeps products beyond the first 200 when a post is saved.

Added

• Block themes: WopCart provides a Single Product template without the post byline, post navigation or comments. A theme's own template or a Site Editor copy still takes precedence; turn it off with the wopcart_register_product_block_template filter.

Fixed

• Downloads are saved under the file's own name when the product file label has no file extension. A label such as "WopCart plugin (zip)" was saved without .zip and could not be opened.
• Checkout: changing the country refreshes every amount, including the line price, the VAT rate label, the total to pay now, the renewal note and the pay button.
• Checkout: when an order is refused, the form keeps what the buyer entered.
• Checkout: the location mismatch message names the detected country and the billing country.
• Checkout and cart: renewal amounts use the same basis as the displayed prices.

Security

• Stripe returns and webhooks accept a Checkout Session only for the order it was created for, with matching currency and a sufficient amount.
• Apple Pay payments can no longer be reused for another order.
• Stripe and PayPal webhooks only complete orders paid with that gateway and matching the payment; PayPal captures must cover the order total.
• Order completion and fulfilment run once even when the webhook and the buyer’s return arrive together, and licences are unique per order line.
• A signed-in buyer who enters another person’s email at checkout no longer gains access to that person’s orders, licences or subscriptions. Their order is filed under their own account and keeps the billing email they entered. Links from earlier versions that do not belong to the account are removed on update and recorded so they can be restored.
• Verified reviews only come from the buyer’s own account or the email review link, and review messages no longer reveal who bought a product.
• Gateway and webhook secrets are no longer printed in admin pages, are stored outside the autoloaded settings, and only administrators can change them.
• REST API routes require the capability that matches their data, API keys follow the user’s capabilities, and failed key attempts are rate limited.
• Discount codes are rate limited on the REST cart, and unknown, inactive and expired codes get the same message in the cart and in payment forms.
• Licensing API rate limits are atomic and count per address and per key. Update packages are only delivered to activated sites; a site that checks for updates is activated automatically while the licence has a free seat. Signed responses carry freshness data that the SDKs check.
• GitHub release webhooks can no longer be replayed to publish pulled versions or unpublish releases.
• Zapier keys are accepted only in the X-WopCart-Key header, and Zapier targets are checked against internal network addresses.
• Product file paths are confined strictly to the uploads folder, including media library attachments.
• The protected download folder’s rules work on Apache 2.4, and System status checks them with a real request.

Changed

• Webhook delivery logs are deleted after 30 days, and privacy erasure now covers webhook deliveries, licences and quotes.
• Privacy erasure also anonymises orders placed with the erased email that are filed under another customer record.
• New Taxes setting to turn off remote IP geolocation.
• The free local/staging environment limit is capped at 10, and 0 now means none. Stores that had 0 (unlimited) are moved to 10.
• Customer records follow a user’s email change, so a changed account email no longer separates a customer from their purchases.
• Bundle licences share their site limit across all products in the bundle; one site uses one seat.

Fixed

• Refund webhooks from PayPal, Authorize.net and 2Checkout are counted once, and Authorize.net refunds made in its dashboard are recorded (requires the Transaction Details API).
• CSV exports also neutralise cells that start with | or with whitespace before a formula.

Added

• SEO-WP integration: product and paywall schema join SEO-WP’s graph, descriptions and Open Graph tags of restricted content are guarded, and store system pages are excluded from SEO-WP sitemaps.
• Review requests: ask buyers for a review in the purchase confirmation, in a separate email N days later, or both. Emails carry five one-click star links that open a short review page.
• Per-product "Ask buyers for reviews" setting, editable and translatable subject and intro text, unsubscribe link (one-click supported) and an optional "only with marketing consent" setting.
• Product schema includes up to 10 published reviews alongside aggregateRating, left out when an SEO plugin already outputs Product markup.
• The Reviews screen shows source (site or email), a pending count and an "Unconfirmed ratings" view.

Changed

• "Only verified buyers may review" is on by default for stores that never saved the Reviews settings.
• Subscriptions with different trial lengths or billing intervals can no longer be bought in one checkout.
• Checkout requires a payment method that can bill subscriptions when the cart contains one.

Fixed

• The invoice number prefix and padding settings had no effect; invoice numbers now use them.
• The Course access settings “Create accounts” and “Revoke access” showed as off before the first save although they were on.
• With SEO-WP active, breadcrumb structured data is left to SEO-WP instead of being printed twice.
• System status now checks for PHP 8.2, the version WopCart requires.
• Saving a product from the pricing tab no longer resets the sign-up fee of its price options to zero.
• Products set to the “E-publication rate” tax class are now taxed at the e-publication rate instead of the digital goods rate.
• The checkout message for subscriptions that cannot be bought together now names billing intervals as well as trial periods.
• The invoice.credited webhook event is now sent when a credit note is issued for an order invoice.
• The API key “write” scope now describes what it allows: refunding orders and cancelling subscriptions.
• Authorize.net is no longer offered for subscription checkouts it would bill wrongly (sign-up fees, first-payment discounts, introductory prices, several subscriptions, or one-off items alongside a subscription).
• PayPal is no longer offered when today’s charge would differ from what PayPal bills, and PayPal sign-up fees now match the order exactly, tax included.
• PayPal and Mollie are no longer offered for carts with more than one subscription.
• 2Checkout is no longer offered for subscriptions with a free trial, a sign-up fee, a first-payment discount or an introductory price.
• Link scanners in email programs can never publish a review; star ratings stay unpublished until the buyer presses Submit.

Added

• “Start over” for PayPal, Mollie and 2Checkout invoice payments once the gateway reports no payment or the attempt window has passed.

Changed

• Invoice payment actions are rate-limited.

Fixed

• The invoice payment page no longer locks the customer out while an earlier payment attempt is open. It offers “Continue to payment” or “Start over”.
• Stripe Checkout sessions for invoices expire with the payment page’s attempt window, and a new session is never created while an earlier one can still be paid.
• A completed Stripe payment is confirmed when the invoice page is opened, so a missed webhook cannot leave a paid invoice unpaid.

Fixed

• Payment form submissions failed because field names were rendered incorrectly.
• Upgrading a subscription plan could be refused by Stripe after an earlier failed attempt.
• The Webhooks screen under Integrations returned “not allowed”.
• EU VAT validation kept showing as unavailable on the Status page after it recovered.

Added

• Payment forms: a block-based form builder with 17 templates for payments, donations, sign-ups, events, surveys, contact and bookings. Fixed, tiered or custom amounts, one-time or recurring, goals with progress bars, entries with CSV export.
• Integrations hub: switch services on and off and configure them in one place, including Mailchimp, Brevo, MailerLite, ActiveCampaign, FluentCRM, Zapier, Make, n8n, Slack, Discord, Telegram, Twilio SMS, Google Sheets, Google Analytics 4 and Meta Conversions API. Marketing and analytics respect consent. Guided step-by-step setup with a connection test, a test event and plain-language errors; connectors not yet confirmed against live accounts are marked Beta.
• Memberships: levels with WordPress roles, access rules for pages, blocks and menu items, member shortcodes, MemberPress compatibility and a setting for paused subscriptions.
• Invoices: EU-compliant invoice details, payment links, resend, void by cancellation credit note, activity history and reminders before, on and after the due date.
• Cart: a cart page and a setting for where buyers go after adding to cart (default: checkout).
• Multilingual and page builders: WPML and Polylang, Divi modules, Bricks elements and more Elementor widgets.
• Design: a new admin dashboard with period comparison, and a redesigned checkout, cart and confirmation with layout and accent colour settings.

Changed

• Physical products can only be paid with gateways that support shipping.
• Once-only coupons are refused on recurring payment forms.
• Requires PHP 8.2 or newer.

Fixed

• EU VAT number validation (VIES) was always reported as unavailable on some servers.
• Discount codes on subscriptions paid with Stripe are now charged exactly as shown. Fixed-amount codes are refused for Stripe subscriptions; percentage codes work.
• Subscription sign-up fees are now charged with Stripe and PayPal.
• Changing a yearly plan could fail.
• Invoice numbering, credit notes for orders without an invoice, and reminder timing.
• Security hardening for permissions, webhook address checks and retry queues.

Added

• Checkout and payments: Stripe checkout, Mollie, discounts and bulk coupons, net and gross price display with unit prices.
• Subscriptions: recurring plans with dunning and a cancellation flow.
• Software licensing: license keys with domain activations and signed license checks.
• Tax and invoicing: EU VAT with VIES validation and reverse charge, OSS-ready invoices, PDF invoices and credit notes, manual invoices with payment links, quotes and refund requests.
• Catalog: physical products and shipping, variants, product categories and permalinks.
• Integrations and automation: LMS access for LearnDash, Tutor LMS and LifterLMS, webhooks with automation presets, MCP and AI abilities.
• Security: anti-spam protection.

Changed

Nothing yet. This is the first release.

Fixed

Nothing yet. This is the first release.