WooCommerce Customer Email Verification Version 2.9.2 Changelog

Here’s what’s changed in WooCommerce Customer Email Verification Version 2.9.2

  * Fix – Snapshot the cart total at the moment the OTP is sent and store it in the session. At validation time, compare against the snapshot instead of the live cart total. If the cart has changed, require re-verification.
* Fix – Return the same generic response for existing-but-unverified and new-email paths so an attacker cannot distinguish between them. Only keep 'already_verified' as a distinct code since it is needed for UX.
* Fix – Add a nonce check at the top of the resend handler using the same nonce the verify handler uses. Return an error if the nonce fails.
* Fix – "Login Now" Button Not Redirecting to Login Page in CEV PRO Checkout Popup
* Fix – Disable WooCommerce Store API Checkout not blocking Block checkout
* Fix – Logged-in users with unverified emails can no longer bypass checkout email verification
* Improvement – Replace mt_rand() with random_int() in the PIN generation loop. random_int() uses a CSPRNG and is safe for security-sensitive token generation.
* Improvement – Add a per-email or per-session attempt counter. After 5 failed attempts, invalidate the current PIN and force the user to request a new one. Return an error telling the user their code has expired due to too many attempts.
* Dev - Tested with WooCommerce 10.6.1
* Dev - Tested with WordPress 6.9.4
  

View the full WooCommerce Customer Email Verification Changelog

(No Ratings Yet)

Loading...