Happy Coders OTP Login for WooCommerce

Àkọsílẹ̀ àwọn àyípadà

2.8

• Security: Fixed a critical authentication bypass vulnerability (CVSS 9.8) reported by the WPScan security team (discovered by moonge). The auto-login handler was incorrectly exposed as a public unauthenticated AJAX endpoint, allowing any visitor with the publicly available nonce to log in as any existing user — including administrators — without OTP verification. The handler is no longer registered as an AJAX endpoint; login is now performed exclusively within the OTP verification handler after server-side confirmation.
• Security: WhatsApp OTP flow no longer creates a WordPress user account at OTP send time. Account creation is now deferred until after the OTP is successfully verified, preventing phantom account creation for unverified numbers.
• Security: WhatsApp OTPs are now stored as short-lived transients (10-minute expiry) and are deleted immediately upon successful verification to prevent replay attacks.
• Security: Resolved a logical flaw in the SMS OTP verification path where the fallback code path could bypass the user-existence check.
• Fix: Send OTP button no longer changes to “Sending…” state when the mobile number field is empty. Validation now runs before the button state changes, so the form correctly shows the error message without disabling the button.
• Fix: WhatsApp option no longer appears in the Resend OTP section when WhatsApp OTP is disabled in settings. The resend buttons now correctly reflect the admin configuration.
• Security: OTP rate-limit counter now initializes to 0 before the database check, preventing a bypass when the rate-limit table is unavailable.
• Security: MSG91 API key and parameters are now properly URL-encoded in the OTP send request, preventing potential injection via special characters in credentials.
• Security: Verification cookies (msg91_verified_mobile, msg91_verified_user_id) are now set with HttpOnly, Secure, and SameSite=Strict flags to prevent JavaScript access and cross-site transmission.
• Security: Duplicate AJAX hook registration for hcotp_send_otp_ajax removed — previously caused each OTP send to be processed twice, including double rate-limit counting and double API calls.
• Security: WhatsApp OTPs are now stored as bcrypt hashes (via wp_hash_password) in both transients and user meta, preventing plaintext OTP exposure if the database is compromised.
• Security: Email account enumeration prevented — sending OTP to an unregistered email now returns a generic success response instead of a distinct error message.
• Security: Settings migration function now requires manage_options capability, preventing lower-privilege admin users from triggering the migration.
• Security: Checkout login notice now uses wc_get_page_permalink() for the account URL instead of a hardcoded path, and output is properly escaped.
• Security: Transactional SMS message templates now saved with sanitize_textarea_field instead of wp_kses_post, preventing HTML tags from being stored and sent inside SMS messages.
• Security: Admin asset versions changed from time() to HCOTP_VERSION, enabling proper browser caching.
• Fix: Server error messages in the OTP form are now rendered with .text() instead of .html() to prevent potential XSS from untrusted response content.
• Fix: Removed console.log statements that were exposing the nonce and plugin configuration in the browser developer console.

2.7

• Fix: Updated blocked numbers table queries to use the active WordPress database prefix instead of hardcoded wp_hcotp_blocked_numbers.

2.6

• Tweak: Added default Email OTP subject/body in settings when fields are empty.

2.5

• Feature: Added customizable HTML email templates for Email OTP messages.
• Feature: Added header/footer image support and preview for Email OTP templates.
• Tweak: Improved Email OTP settings UI and template controls.

2.4

• Feature: Added Email OTP login option.
• Tweak: Updated plugin version to 2.4.

2.3

• Feature: Added ‘otp_length’ parameter to the MSG91 API call for dynamic OTP length.
• Tweak: Updated plugin version to 2.3.

2.2

• Feature: Added setting to configure OTP length dynamically (4 or 6 digits).
• Tweak: Updated plugin version to 2.2.
• Fix: Minor bug fixes and improvements.

2.1

• Feature: Introduced customizable transactional SMS message templates with dynamic variable support (e.g., ##customer_name##, ##order_id##).
• Tweak: Enhanced settings page to allow direct input of SMS message templates using descriptive variables.
• Fix: Ensured backward compatibility for existing SMS notes by repurposing the field for message templates.

2.0

• Fix: Corrected an issue where SMS settings were not being saved properly.
• Feature: Added a migration function to move old settings to a new format.

1.9

• Fix: General bug fixes and performance improvements.

1.8

• Fix: General bug fixes and performance improvements.

1.7

• Feature: Added support for sending OTPs via WhatsApp.
• Tweak: Improved UI and clarity on the settings pages.
• Fix: General bug fixes and performance improvements.

1.6

• Fix: Minor bug fixes and overall improvements for better performance and stability.

1.5

• Feature: Added automated SMS notifications for New User Registration, Order Placed, Order Shipped, Order Completed, and Abandoned Cart.
• Tweak: Enhanced admin settings UI for managing new transactional SMS features.
• Fix: Minor bug fixes and improvements.

1.0.0

• Initial release with OTP login features (full-screen and popup) and core MSG91 integration.