v2.0.9 — Security hardening

Security hardening release for the Fundiin Payment Gateway for WooCommerce GitHub distribution.

Security changes

• Require WordPress authentication, manage_woocommerce, and an exact merchant match for merchant export REST routes; retire shared RSA authorization.
• Validate query filters and bounded pagination; omit order access keys from exports.
• Authenticate payment notifications with merchant HMAC and validate the order gateway, payment reference, amount, and currency. Browser returns no longer mutate payment state.
• Escape checkout script URLs and stop rendering legacy arbitrary scripts.
• Enforce TLS verification, refuse outbound HTTP redirects, validate payment destinations, and stop logging credentials or customer payloads.
• Require management permission for settings writes and refunds.

Upgrade notes

• Download fundiin-woocommerce.zip below and upload it in WordPress → Plugins → Add New → Upload Plugin. The archive preserves the previous release's fundiin-woocommerce directory.
• Requires PHP 7.4+. Merchant API clients must migrate to WordPress authentication; Application Passwords over HTTPS require WordPress 5.6+ and a user with manage_woocommerce.
• Export pagination defaults to 50, allows limit 1–100 and offset, and rejects unbounded limit: -1.
• Rotate credentials that may have been exposed by older logs and remove old sensitive log copies.

Verification

• 75 standalone security regression assertions and PHP syntax checks passed on PHP 7.4, 8.2, and 8.5 in GitHub Actions.
• The ZIP contents match commit e1dd23e348e72813d9f6333b16341c6aa7410912; a SHA-256 checksum is attached.
• Full WordPress/WooCommerce sandbox checkout and refund integration tests have not been run. Validate your store's payment flow before production rollout.

CVE scope

This release hardens the code in this GitHub repository. It does not update the separate WordPress.org package and is not an independent confirmation that CVE-2026-81649 is resolved for that distribution. See SECURITY.md and CHANGELOG.md for migration details and verification limits.

v2.0.8

Add files via upload

v2.0.7: Merge pull request #21 from fundiin/feat/strip

Feat/strip

v2.0.6

Merge pull request #21 from fundiin/feat/strip

Feat/strip

v2.0.5

Full Changelog: v2.0.4-release...latest

v2.0.4

Merge pull request #16 from fundiin/v2.0.4

Update 2.0.4

v2.0.3

What's changed

• Add Fundiin_Logger @binhotvn #15

Full Changelog: https://github.com/fundiin/Fundiin_Wordpress_Plugin/commits/latest

v2.0.2

What's Changed

• Feat/update shipping by @binhotvn in #1
• Update server by @binhotvn in #2
• Update server by @binhotvn in #3

Full Changelog: https://github.com/fundiin/Fundiin_Wordpress_Plugin/commits/latest

v2.0.8

What's Changed

• Update 2.0.4 by @binhotvn in #16
• V2.0.5 siteid by @binhotvn in #18
• V2.0.5 siteid by @binhotvn in #19
• v2.0.6 - storeId by @binhotvn in #20
• Feat/strip by @binhotvn in #21

Full Changelog: latest...v2.0.7