NMI for WooCommerce

Changelog

1.0.5

Security

• The private NMI security key is no longer written to the WooCommerce debug log. Credentials in the outbound request are replaced with ***REDACTED*** before logging (CWE-532). Redaction walks nested arrays and objects, and any configured credential value is scrubbed from the log text as a final safety net.
• Enabled TLS certificate verification (sslverify) on every request to the NMI API. The key was previously sent over an unverified connection.
• Webhook signature comparison now uses hash_equals(), removing a timing side channel on the webhook signing key.
• The webhook client IP is validated and unslashed before the allow-list check.
• Raw gateway responses are no longer printed into customer-facing checkout notices or order notes.
• process_payment() and add_payment_method() now verify the gateway nonce themselves, so block (Store API) checkout is covered as well as classic checkout. The eCheck form gained the nonce field it was missing.
• Added wp_unslash() to all remaining $_POST / $_SERVER reads, and sanitized the eCheck descriptor, processor_id and merchant_defined_field values.

Fixed

• Checkout could not complete on WooCommerce 11. The form was submitted with a native submit(), which does not contribute the Place Order button’s own name/value pair; WooCommerce gates WC_Form_Handler::checkout_action() on exactly that field, so the request was discarded with no order, no error notice and no log entry. The field is now sent explicitly.
• Removed the customCss block passed to CollectJS.configure(). Collect.js validates it against a narrow whitelist and rejects the whole call if any property falls outside it, which left the hosted card fields unmounted so no token was ever produced.
• The Cart and Checkout blocks payment method no longer declares a jquery-blockui dependency. WooCommerce registers that script as wc-jquery-blockui and keeps jquery-blockui only as a legacy handle on the classic frontend, so in the blocks context the dependency was unresolvable and WooCommerce deactivated the payment method. BlockUI is now called through helpers that no-op when it is unavailable.
• get_icon() no longer echoes. The cardtypes multiselect defaults to a bare string, so the is_array() branch never matched on a fresh install and control fell through to a branch that printed markup; WooCommerce also calls this method while assembling Store API JSON for block checkout, where that output corrupts the response.
• The admin settings screen now hangs its stylesheet off the hook suffix add_submenu_page() returns instead of a hand-reconstructed one, and a stray brace in the stylesheet was removed.
• Credit card merchant_defined_field_1-20 values were written to the eCheck argument array and never sent to the gateway.
• The NMI Settings page no longer fatals when the Freemius global is unset.
• Declared every gateway property explicitly. PHP 8.2 deprecates creating them dynamically, which emitted roughly 38 notices per request on PHP 8.2 and later.
• Corrected the Installation instructions, which named a directory the plugin has never shipped as.

Compatibility

• Tested up to WordPress 7.1 and WooCommerce 11.0; minimum PHP raised to 7.4 and minimum WordPress to 6.0.
• Updated the bundled Freemius SDK from 2.13.0 to 2.13.4.
• Updated Plugin URI and Author URI (wpclubz.com no longer resolves).

Coding standards

• Global functions now use the unique nmifw_ prefix instead of the three-character nmi_, and the checkout block class was renamed from WC_NMI_Blocks_Payment_Method to NMIFW_Blocks_Payment_Method so it no longer sits in WooCommerce”’s WC_ class namespace. Gateway class names, gateway IDs and the plugin”’s public filter names are unchanged, so saved settings, tokens and third-party integrations keep working.
• Replaced the hand-rolled request encoding with http_build_query() (byte-identical output) and print_r() debug dumps with a redaction-aware JSON helper.
• Removed the discouraged load_plugin_textdomain() call; WordPress loads translations automatically for plugins hosted on WordPress.org.
• The readme name now matches the plugin header and drops the restricted term “wp”.
• Added the missing translators comments and replaced json_encode() with wp_json_encode(). The plugin reports no errors or warnings under the WordPress Coding Standards security, i18n and database sniffs.
• The admin stylesheet now only loads on the plugin”’s own screens.

1.0.4

• Load Gateway.js and Collect.js from NMI official CDN URLs (fixes JavaScript syntax errors from corrupted bundled vendor files; aligns with NMI documentation)
• Added WooCommerce Checkout Block support (registerPaymentMethod + Collect.js / 3DS via Store API)
• Fixed “Payment Token not received” by reading POST with wp_unslash instead of filter_input (PHP/WP compatibility)
• Fixed payment token hidden inputs: use jQuery .val() so JSON is not corrupted in HTML attributes
• Fixed process_payment: decode Collect.js JSON as object; derive card display fields after vault branch (saved cards no longer hit NMI card object first)
• Inline card field mode shows a clear message in block checkout (use classic checkout or disable inline fields)

1.0.3

• Added High-Performance Order Storage (HPOS) compatibility declaration
• Replaced all update_post_meta/get_post_meta with HPOS-compatible $order methods
• Replaced deprecated direct property access ($order->id, $order->parent_id) with getter methods

1.0.2

• Fixed “Nonce Value Missing” error on checkout
• Fixed JavaScript event and selector mismatches preventing Collect.js tokenization
• Fixed saved card token field name references to match gateway ID
• Added nonce security field to the payment form
• Guarded eCheck gateway registration when class is not loaded

1.0.1

• Integrated Freemius SDK

1.0.0

• Initial release version