v1.3.1 2026-08-10
Security hardening & reliability
- Fix Webhooks for Razorpay, Paystack, Mercado Pago, and NOWPayments now correctly process pending payments.
- Improvement Payment redirect pages are now safe to reload — duplicate receipts and redundant notifications are prevented.
- Improvement PayPal and Coinify webhooks require signing secrets to be configured; unverified requests are rejected.
- Improvement Proxy-spoofed IP headers can no longer bypass per-IP rate limits (unless trusted proxy ranges are explicitly configured).
- Improvement Encrypted gateway secrets now refuse to operate when WordPress security keys are absent, with a clear admin notice.
- Fix Removed the request scanner that was blocking legitimate form fields; SQL safety is still enforced at the database layer.