Release v2.9.2
Customer Email Verification for WooCommerce v2.9.2
What's new in v2.9.2
Customer Email Verification for WooCommerce v2.9.2 was released on . The Customer Email Verification will verify your customers' email addresses during registration and checkout to reduce registration and spam orders. See the full changelog below and compare with the complete version history.
Release details
Released
1.1 MB
File unavailable
Changelog
Fixed
- – Snapshot the cart total at the moment the OTP is sent and store it in the session. At validation time, compare against the snapshot instead of the live cart total. If the cart has changed, require re-verification.
- – Return the same generic response for existing-but-unverified and new-email paths so an attacker cannot distinguish between them. Only keep 'already_verified' as a distinct code since it is needed for UX.
- – Add a nonce check at the top of the resend handler using the same nonce the verify handler uses. Return an error if the nonce fails.
- – "Login Now" Button Not Redirecting to Login Page in CEV PRO Checkout Popup
- – Disable WooCommerce Store API Checkout not blocking Block checkout
- – Logged-in users with unverified emails can no longer bypass checkout email verification
Improved
- – Replace mt_rand() with random_int() in the PIN generation loop. random_int() uses a CSPRNG and is safe for security-sensitive token generation.
- – Add a per-email or per-session attempt counter. After 5 failed attempts, invalidate the current PIN and force the user to request a new one. Return an error telling the user their code has expired due to too many attempts.
Other
- Dev - Tested with WooCommerce 10.6.1
- Dev - Tested with WordPress 6.9.4
Compatibility
- Requires WordPress
- 6.0
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
Customer Email Verification for WooCommerce v2.9.2 scanned clean with no security threats detected.
View full scan report