=== MixPay Crypto Payment Gateway for WooCommerce ===

Contributors: mixpay
Tags: crypto, payment, payment gateway, mixpay, bitcoin
Requires at least:       5.5
Tested up to:            6.6
Requires PHP:            7.2.24+
WC requires at least:    4.9.4
WC tested up to:         9.3
Stable tag:              1.1.13
License:                 GPLv2 or later
License URI:             http://www.gnu.org/licenses/gpl-2.0.html

MixPay Payment is a service that allows users to with numerous supported cryptocurrencies

== Changelog ==

= 1.1.13 - 2026-10-19 =
* Security: Bound payment results to the original WooCommerce order, MixPay payee, currency, and amount; invalid or mismatched results leave the order unchanged
* Security: Verified payment-code details before saving the order's payment binding, and rejected malformed or unrelated callback order identifiers
* Security: Verified callback source IPs for direct connections, trusted Cloudflare connections, or explicitly configured reverse proxies; unverified forwarded headers are no longer accepted
* Reliability: Serialized payment creation and callbacks per order, with short throttling for repeated upstream result lookups
* Fix: Allowed failed orders to retry only after MixPay confirms the previous attempts failed, using a separate payment attempt ID
* Fix: Reused reserved attempt IDs after interrupted requests and recovered incomplete retry activation without replacing an active payment
* Fix: Prevented callbacks for older attempts from changing the current attempt; unexpected late payments on older attempts are flagged for manual review
* Fix: Kept confirming and underpaid payments on hold, including during retry recovery; successful payments still move to processing
* Fix: Loaded the configured payment title and description in Blocks checkout and removed an uninitialized-variable warning in classic checkout
* Maintenance: Aligned plugin and package version metadata to 1.1.13; no dependency upgrades

= 1.1.12 - 2026-03-23 =
* Removed legacy cron polling mechanism for payment status checks
* Added one-time cleanup to remove accumulated cron events from previous versions
* Improved callback handler with better error handling and input validation
* Made order status updates idempotent for terminal states

= 1.1.11 - 2025-11-21 =
* Improved order status mapping with WooCommerce standards
* Enhanced payment validation and error logging
* Fixed order status overwrite issues

= 1.1.10 =
* Previous stable version

== Upgrade Notice ==

= 1.1.13 =
Security and payment-retry update. Payment results must match the order's original payee, currency, and amount before they can change its status. Confirming and underpaid payments remain on hold; successful payments still move to processing.

Before upgrading, check the Callback IP security section if your store uses a reverse proxy other than Cloudflare. Such proxies require explicit trusted-proxy configuration and a verified client-IP header; unverified forwarded headers are not accepted.

Review older unpaid orders manually if their MixPay payee or invoice prefix has changed. Custom order-number plugins may also require manual review for older orders without a stored MixPay binding. A locally failed order can be retried only when MixPay independently confirms its previous payment attempts failed.

== Description ==
MixPay for WordPress - The Ultimate Crypto Payment Solution for Merchants

MixPay (https://mixpay.me) is a Web3-based payment protocol that brings a secure, privacy-focused crypto payment solution to your WordPress store. Say goodbye to costly fees and complex integrations, and start accepting a wide range of cryptocurrencies with ease.

**Quick Start**

1. [Installation](https://wordpress.org/plugins/mixpay-gateway-for-woocommerce/#installation)
2. Register an account & Get your UUID - [MixPay Dashboard](https://dashboard.mixpay.me)
3. [Tutorial](https://help.mixpay.me/en/articles/6836912-mixpay-wordpress-plugin-deployment-tutorial)

**Why Choose MixPay?**

- **Privacy First:** No KYC required for customers, ensuring complete user privacy.
- **Seamless Settlement:** Instant settlements in USDT, reducing exposure to crypto market fluctuations.
- **Cost-Effective:** Zero integration fees, zero service fees.
- **Broad Crypto Support:** Accept payments from 15+ blockchains and 50+ cryptocurrencies, including BTC, ETH, DOGE, SOL, LTC, and more.
- **Full Asset Control:** MixPay never holds your funds—you stay in control.
- **Simple Integration Options:** Choose from APIs, WordPress Plugin, and Shopify Plugin to integrate with your store effortlessly.

With MixPay, give your customers a flexible and secure way to pay, while you enjoy reliable and fast settlements, zero hidden fees, and robust protection against high-risk transactions. Install the MixPay plugin today and empower your business with secure, hassle-free crypto payments!


**Business cases:**

- [https://coinsbee.com](https://coinsbee.com)
- [https://onekey.so](https://onekey.so)

**Contact**

- Business: [bd@mixpay.me](mailto:bd@mixpay.me)
- Customer support: [customer@mixpay.me](mailto:customer@mixpay.me)

**Social**

- Official: [https://mixpay.me](https://mixpay.me)
- LinkedIn: [https://www.linkedin.com/company/mixpay](https://www.linkedin.com/company/mixpay)
- Twitter: [https://twitter.com/MixPayProtocol](https://twitter.com/MixPayProtocol)


== Installation ==

**Plugin installation**

1. Please make sure [PHP BCMath](https://www.php.net/manual/en/book.bc.php) installed in your server.
2. Upload the mixpay-woocommerce-plugin directory to the /wp-content/plugins/directory.
3. Activate the plugin through the “Plugins” menu in WordPress.

After the plugin is activated, MixPay Payment will appear in the WooCommerce>Payments section.

**Plugin configuration**

After you have installed the MixPay Payment plugin, the configuration steps are:

1. On the WooCommerce “Settings” page, go to the “Payment Gateways” tab, then click “MixPay Payment”.
2. Check “Enable MixPay Payment”.
3. Register an account [https://dashboard.mixpay.me](https://dashboard.mixpay.me) and activate your account.
4. Specify your Payee Uuid And Settlement Asset
5. Click “Save changes” and the gateway will be active.

**Callback IP security**

The callback endpoint accepts MixPay's documented source IP, `52.198.117.57`. Behind Cloudflare, it also accepts that source when `REMOTE_ADDR` is within Cloudflare's published IP ranges (https://www.cloudflare.com/ips/) and Cloudflare's single `CF-Connecting-IP` header matches the MixPay IP. The bundled Cloudflare ranges must be checked against the official list when releasing an update.

For another reverse proxy, first make the proxy verify its own upstream and overwrite a dedicated `X-MixPay-Verified-Client-IP` header (discard any client-supplied value). Then configure its exact trusted CIDRs with the `woocommerce_mixpay_callback_trusted_proxy_cidrs` filter. Otherwise callbacks remain blocked. Never add a shared proxy IP to `woocommerce_mixpay_callback_allowed_ips`: that filter is only for MixPay's actual callback IPs. Never trust an unverified `X-Forwarded-For` header.

**Tutorial**

https://help.mixpay.me/en/articles/6836912-mixpay-wordpress-plugin-deployment-tutorial


== Screenshots ==

1. MixPay Payment
2. MixPay Checkout Page
3. Ease of use
