Conekta Payment Gateway

Changelog

6.2.2

• Security: harden the order.paid webhook against forged/replayed events (bind to the API-verified order, amount/currency check, idempotency per Conekta order).

6.2.1

• Fix: on iOS Safari (classic checkout) the 3DS challenge could be unreachable taps on the OTP field never landed because the loading overlay intercepted them. The overlay now lets the interaction through while the rest of the form stays blocked during the charge.

6.2.0

• Change: order-first card checkout on WooCommerce Blocks the same inversion 6.1.0 brought to classic. “Realizar el pedido” now creates and validates the WooCommerce order FIRST; the card is charged only after the order exists and is linked to the Conekta order (reference_id + conekta-order-id meta + real customer data). A card can no longer be charged for a checkout WooCommerce rejects or that fails mid-flight the exact failure that produced a double charge in production: the charge used to fire before the Store API checkout, and when that call died the payment was left with no WooCommerce order at all.
• Change: every card charge on Blocks is now preceded by a two-way ConektaWooCommerce link, so a lost confirmation leaves a pending order the order.paid webhook completes correctly instead of fabricating a degraded guest order from the Conekta payload.
• Feature: in-page “Reintentar pago” after a declined charge or a failed confirmation. The retry re-runs only what is pending (a decline re-charges; a lost confirmation only re-confirms) and never charges twice.
• Feature: Conekta orders now carry metadata.woocommerce_customer_id the WooCommerce user behind the purchase, on every payment method sent only when a registered customer exists (guests get no key).

6.1.1

• Fix: the same cart could be charged twice in Conekta (two paid Conekta orders for one purchase). When a charge succeeded but the WooCommerce order was never completed confirm call lost, a 3DS challenge navigating the page away, or the customer reloading the checkout the plugin created a replacement Conekta order and showed a fresh payment form, so the customer paid again. The checkout now checks the payment status before replacing an order, never replaces a paid one, and instead completes the WooCommerce order that payment belongs to and sends the customer to it.
• Fix: the checkout no longer shows a payable form after a successful charge. On Blocks, retrying “Place order” after a charge whose checkout failed reuses the existing payment instead of charging again.

6.1.0

• Change: order-first card checkout (classic). “Place order” now creates the WooCommerce order (pending) BEFORE any charge; the Conekta charge fires only after the order exists and is linked (reference_id + real customer data), and a confirm endpoint completes it. A card can no longer be charged for an order WooCommerce refused or failed to create.
• Fix: paid Conekta orders no longer keep the “Cliente” / “0000000000” / “Pendiente” placeholders the real name, phone and address from the placed order are pushed to Conekta right before charging.
• Fix: order.paid webhooks for Blocks orders stuck in checkout-draft now complete correctly (payment_complete silently ignores drafts; they are promoted to pending first). Previously the paid order stayed invisible in the admin.
• Feature: last-resort recovery an order.paid webhook with no matching WooCommerce order now creates one from the Conekta payload (products resolved via product_id line-item metadata). Mainly covers wallet payments (Apple/Google Pay) that charge without going through “Place order”.

6.0.7

• Fix: the card checkout no longer fails with a 422 “Invalid format for shipping_contact … city”. An empty city (chosen address block had a street but no city) is now backfilled from the other block, and the card path sends shipping_contact/customer_info with metadata.soft_validations so Conekta warns instead of rejecting odd-but-usable values. Previously both the order update and the recreate failed, so the shopper couldn’t pay.

6.0.6

• Change: line items are sent to Conekta at the effective price the customer pays; the plugin no longer reports the regular price plus a dynamic_pricing discount for sales (that confused merchants and made the IVA appear as a phantom discount on tax-inclusive stores). Tax is itemized in tax_lines; real coupons and fees stay as discounts. Covers card, cash, bank transfer, BNPL and pay by bank.
• Feature: each line item carries a tax_included metadata flag (true only when the store is tax-inclusive and the product is taxable).

6.0.5

• Fix: classic checkout submits the exact data it validated before charging (FormData snapshot), so a third-party plugin changing a required field during the payment window (e.g. a postcode->colonia repopulator) can’t make WooCommerce reject the order after the card was already charged. Covers card and wallet paths.

6.0.4

• Fix: classic checkout no longer leaves a card payment without an order. The conekta-order-id link is written on the WooCommerce order before completion, so the order.paid webhook can always recover and finish the order if process_payment fails the same safety net Blocks already has.
• Feature: stamp the WooCommerce order id as reference_id on each card charge (PUT /charges/{id}) for Conekta-to-WooCommerce traceability. Best-effort; never blocks checkout.
• Diagnostics: added targeted logs for the silent failure points (post-charge validation rejections, not-paid / amount-mismatch / duplicate branches, missing conekta_order_id).

6.0.3

• Feature: send the WooCommerce order id as the Conekta order reference_id on the Blocks checkout (read from the checkout-draft order before payment). Classic keeps the reverse conekta-order-id order meta.
• Fix: “Undefined array key instructions” warning during checkout on the cash, bank-transfer and pay-by-bank gateways for configs saved before the instructions field existed.

6.0.2

• Fix: prevent duplicate WooCommerce orders from a single Conekta payment when the checkout is resubmitted (double-click, timeout, retry).
• Fix: build the Conekta shipping contact from a single address block uses shipping when filled, otherwise billing as a whole; the contact phone follows the same block.

6.0.1

• Security fix in the checkout integration. Updating is strongly recommended.

6.0.0

• BREAKING: Card payments migrated from the Card tokenizer SDK component to the Integration SDK component. The Conekta order is pre-created at iframe-mount time and updated via PUT on every cart change; process_payment only validates the already-paid order against the WooCommerce total.
• Feature: New endpoint POST /conekta/v1/checkout-request that creates or updates the Conekta Integration order. customer_info and currency are set once at creation; line_items/discount_lines/shipping_lines are PUT on every cart change.
• Feature: Amount-mismatch guard in process_payment requires payment_status=’paid’ AND conekta_order.amount equals WooCommerce total before completing the order.
• Feature: MSI is now passed via the Integration checkout config (monthly_installments_enabled defaults to false; merchant-configured plazos travel as monthly_installments_options).
• Removal: Custom 3DS handling, the create_3ds_order REST endpoint, the three_ds_enabled/three_ds_mode properties, and the company API helper. The Integration SDK handles 3DS internally.
• Removal: JS no longer scrapes the DOM or ships cart/billing/shipping payload the request body is now { nonce } and the server reads WC()->cart + WC()->customer directly (kept in sync by WooCommerce).
• Removal: Fragment system (#conekta-cart-data and the woocommerce_update_order_review_fragments filter).
• Cleanup: conekta_settings localized to classic JS reduced from 11 keys to 5. Token + MSI hidden fields replaced by a single conekta_order_id hidden field.
• Compat: WooCommerce Blocks checkout migrated to the same flow paymentMethodData is now { conekta_order_id }.

5.4.15

• Fix: ckpg_build_tax_lines now reads tax_total/shipping_tax_total from WC_Order_Item_Tax objects (WooCommerce 3.0+), so IVA over items and shipping is reported correctly to Conekta instead of being collapsed into a “Round Adjustment” line

5.4.14

• Fix: Webhook order.paid/order.expired now uses wc_get_order() with fallback lookup by conekta-order-id meta, fixing HPOS compatibility and 3DS temp order mismatch
• Fix: validate_reference_id now rejects empty, non-numeric, zero, and negative values
• Enhancement: Optimized WordPress.org SVN deployment exclude dev files, add --delete for clean sync, use --no-dev for composer, and shallow SVN checkout to skip historical tags
• Enhancement: Reduced CI log noise with quiet flags on svn, rsync, and apt-get commands

5.4.13

• Enhancement: Optimize WordPress.org SVN deployment exclude dev files, add --delete for clean sync, use --no-dev for composer, and shallow SVN checkout to skip historical tags
• Enhancement: Reduce CI log noise with quiet flags on svn, rsync, and apt-get commands

5.4.12

• Feature: Full support for “Advanced Dynamic Pricing and Discount Rules” plugin and similar dynamic pricing plugins
• Feature: Three discount detection sources for Conekta discount_lines: native WC coupons, fee-based discounts, and price-level discounts
• Feature: Conekta line_items now use the original regular_price as unit_price, with the dynamic discount sent separately in discount_lines
• Fix: 3DS classic checkout now recalculates cart via calculate_totals() so dynamic pricing hooks fire before order creation
• Fix: 3DS order creation uses explicit subtotal/total from the cart instead of catalog prices, preserving all plugin-applied discounts
• Fix: Cart fees (negative fees from dynamic pricing) are now copied to the 3DS WC order
• Enhancement: New fragment system keeps JS-side conekta_settings in sync after every checkout AJAX refresh
• Enhancement: Classic checkout JS now sends discount_lines in the 3DS request and updates cart data from fragments
• Enhancement: Price-level discount detection applied consistently across all 6 payment gateways
• Tests: 40 PHPUnit tests with 127 assertions covering discount detection, cart snapshots, fee handling, balance verification, and edge cases

5.4.11

• Fix: Resolved fatal error when plugin is activated without API key configured by moving 3DS company fetch inside api_key guard

5.4.10

• Security: Added CSRF protection to the WC AJAX 3DS order endpoint via nonce verification
• Security: Nonce is now generated in PHP and passed to Classic and Blocks checkout scripts, then verified server-side before processing

5.4.9

• Fix: Resolved 404 errors on checkout and 3DS endpoints when WordPress is installed in a subdirectory
• Fix: Replaced hardcoded URLs with dynamic WordPress functions (WC_AJAX::get_endpoint and rest_url) for Classic and Blocks checkout

5.4.8

• Fix: Resolved critical issue where discount_lines were not being sent to Conekta in 3DS orders
• Fix: Coupons now correctly apply to orders created during 3DS authentication flow
• Enhancement: Added automatic coupon detection and application from WooCommerce cart for both Classic and Blocks checkout
• Enhancement: Implemented intelligent fallback mechanism to capture discounts when frontend data is unavailable
• Enhancement: Improved discount handling consistency between WooCommerce Blocks and Classic checkout with 3DS enabled

5.4.7

• Fix: Improved shipping method handling in classic checkout by prioritizing conekta_settings
• Fix: Enhanced fallback logic for label and cost extraction in shipping information
• Enhancement: Added shipping information handling in classic checkout script

5.4.6

• Chore: Re-release of the plugin to address deployment configuration

5.4.5

• Feature: Added BBVA Pay by Bank (Pago Directo) payment method support
• Feature: Automatic device detection for payment redirect (desktop uses web URL, mobile uses deep link)
• Feature: Added order expiration configuration in minutes (10-1440 min) for Pay by Bank
• Enhancement: Automatic payment window opening with intelligent fallback for blocked popups
• Enhancement: Improved user experience with seamless BBVA payment flow

5.4.4

• Fix: Resolved issue where classic checkout was not sending product names correctly in 3DS validation
• Fix: Eliminated ‘Temporary 3DS validation’ placeholder appearing in classic checkout orders
• Enhancement: Classic checkout now sends real cart item data (product names, quantities, totals) to Conekta API
• Enhancement: Improved cart data handling consistency between WooCommerce Blocks and Classic checkout
• Enhancement: Added fallback mechanism to retrieve cart data from WooCommerce session when not provided

5.4.3

• Fix: Resolved shipping_lines amount not being sent correctly for credit card payments
• Fix: Corrected double conversion to cents issue that caused incorrect shipping amounts
• Enhancement: Improved shipping data capture from both WooCommerce Blocks and Classic checkout
• Enhancement: Added comprehensive shipping method support for credit card payment flows
• Enhancement: Better consistency between payment methods for shipping cost handling

5.4.2

• Enhancement: Updated Conekta PHP SDK to v7.0.5 and refactored to use new SDK methods.

5.4.1

• Fix: Classic checkout now properly supports 3D Secure (3DS) functionality

5.3.0

• Removes klarna image and adds aplazo image.

5.2.6

• Handle bank transfer payment method

5.2.5

• Removes useless alert in error handling

5.2.4

• Fix issue with tokenizer container unmount

5.2.3

• Fix hardcoded url in classic checkout

5.2.2

• support card payment integration with Conekta Component was recovered, support for classic-checkout was added

5.2.1

• Revert support card payment integration with Conekta Component

5.2.0

• support card payment integration with Conekta Component

5.1.0

• Added bnpl payment method

5.0.9

• Added support for custom rates and discounts

5.0.8

• Upgrade WordPress version

5.0.7

• Test on WordPress 6.7.1

5.0.6

• Fix instructions environment

5.0.5

• Fix webhook functionality
• add missing fields such as instructions,icons
• add field account_owner

5.0.4

• Fix change version release

5.0.3

• Fix Available compatibility mode, dont show clabe for SPEI/cash

5.0.2

• Fix webhook for paid orders
• Automatically config webhook in the plugin settings

5.0.1

• Fix unauthorized Client

5.0.0

• Revert all payment methods in one, Now you can choose which methods you want to use separately

4.0.4

• Fix error in coupon amount when coupon type is percentage
• Render icons in the checkout page depending on the plugin settings
• Set logic for canMakePayment in the checkout page

4.0.3

• Fix status orders, new orders are created with status “pending payment” and not “on-hold”

4.0.2

• Fix error when creating order with empty shipping contact

4.0.1

• Fix installing plugin in php 7.4

4.0.0

• Update conekta-php library
• Checkout Blocks compatibility.
• Updated to the new redirected checkout process: Conekta Component.
• Simplified integration process using one API key for all payment methods.

3.7.7

• fix shipping line amount

3.7.6

• supports events listening (order.expired and order.cancelled) for OXXO and SPEI
• update order status (cancelled and expired)

3.7.5

• Fix error when create charge in php 7.4

3.7.2

• Update versions

3.7.1

• Update conekta-php library

3.7.0

• Homogenization with WordPress standards

3.0.8

• Fix problem whit amount in discount_lines

3.0.7

• Fix problem whit amount -1
• Fix problem whit reference oxxo pay

3.0.6

• Fix problem with amount -1

3.0.5

• Updated images for Conekta Payments

3.0.4

• Fix for error token already used

3.0.3

• Update PHP Lib compatible with PHP 7+

3.0.2

• Fix: Order info in email templates
• Feature: Custom instructions and description for Oxxo and Spei payment

3.0.1

• Fix: Fix library issues.

3.0.0

• Changed: Access correctly to order properties (Support WooCommerce 3.x).

2.0.14

• Style: Correction in typo for email

2.0.13

• name the SPEI account owner in admin input section[NEW FEATURE]
• new marketplace review validations

2.0.12

• Fixes round adjustment for non-integer values
• sends plugin version in line items tag.

2.0.11

• Fixes issue of token_id missing.

2.0.10

• Fix monthly installments

2.0.9

Fix tax line empty description

2.0.8

change name of translation inside comment.

2.0.7

Fix sku less than 0 characters

2.0.6

Fix shipping for card and spei

2.0.5

• Fix shipping validations for virtual products
• Fix rounding for non-integer cents
• Add expiration date for oxxo pay
• Fix webhooks for paid orders

2.0.0

• Added taxes
• Added discounts
• Added shipping
• Added orders
• Oxxo pay
• Fix webhooks for paid orders (previously paid charges)
• Remove Banorte

0.3.0

• Added additional parameters required for more robust anti-fraude service for card payments

0.2.0

• Added option for differed payments for 3, 6, and 12 months
• Enable or disable differed payments from the admin

0.1.1

• Offline payments
• Barcode sent in mail and displayed in order the confirmation page
• Order Status changed dynamically once webhook is added in Conekta.io Account

0.1.0

• Online payments
• Sandbox testing capability.
• Option to save customer profile.
• Card validation at Conekta’s servers so you don’t have to be PCI.
• Client side validation for credit cards.