PayPlus Payment Gateway

PayPlus Payment Gateway for WooCommerce
Accept debit and credit cards on your WooCommerce store in a secure way with the ability to design your own payment page and add high functionalities to it. SSL is not required.

Supported PHP Versions:
This plugin is compatible with PHP versions from 7.4 up to 8.3.

Before installation:
You need your account credentials. For that, you have to contact PayPlus and to join the service.

Plugin Disclaimer:
PayPlus does not accept liability for any damage, loss, cost (including legal costs), expenses, indirect losses or consequential damage of any kind which may be suffered or incurred by the user from the use of this service.

It is important to know that this plugin relies on third-party services.
However, the third-party so mentioned is the PayPlus core engine at their servers – the providers of this plugin.

By being a payment processor, just like many of its kind, it must send some transaction details to the third-party server (itself) for token generation and transaction logging statistics and connecting to invoices.

It is this transfer back and forth of data between your WooCommerce and the PayPlus servers that we would like to bring to your attention clearly and plainly.

The main links to PayPlus, its terms and conditions, and privacy policy are as listed:
– Home Page: https://www.payplus.co.il
– Plugin Instruction page: https://www.payplus.co.il/wordpress
– Terms and Conditions: https://www.payplus.co.il/privacy

The above records, the transaction details, are not treated as belonging to PayPlus and are never used for any other purposes.

The external files referenced by this plugin, due to WordPress policy recommendations, are all included in the plugin directory.

8.2.3 – 08-07-2026

• Feature – New “Show loader during iframe payment & redirect” option: displays a processing spinner over the iframe when payment is submitted, then a full-screen redirect loader when order completes.
• Fix – Classic checkout: reopening an iframe popup/same-page payment after closing without paying no longer falls back to redirect mode (duplicate payment page fix now correctly returns the cached link for inline modes).
• Fix – Blocks checkout: processing loader, if activated, no longer appears immediately when the iframe opens; it now correctly waits for the user’s payment submission.
• Fix – Cron: payment_complete() now fires while the order is still pending (matching regular callback behavior), ensuring the “Payment complete” order note is recorded.

8.2.2 – 24-06-2026

• Security – Hosted payment and order completion AJAX handlers now verify order ownership before acting. Prevents unauthenticated metadata tampering and order-key disclosure. (Reported by Pedro Pinho and kevin @OPCIA via WPScan/Automattic)
• Fix – Checkout: “Place Order” button no longer flickers when switching payment methods.
• Fix – Cron: when “Payment Completed” is enabled, cron-recovered orders now correctly fire the woocommerce_payment_complete hook.

8.2.1 – 10-06-2026

• Fix – Payment page: prevented duplicate payment page creation per order by saving the meta fields the existing duplicate-prevention guard relies on. Eliminates duplicate PRUID entries.

8.2.0 – 07-06-2026

• Fix – Cron: when “Exclude manually cancelled orders from cron” checkbox is enabled, orders cancelled by an admin or shop manager are now excluded from cron instead of deleting payment data.
• Fix – Cron: order status change hook registers only once, preventing duplicate order notes. Works for admins and shop managers via admin, AJAX, or REST.
• Fix – Cron: minimum order age reduced to 10 minutes for faster processing.
• Tweak – Settings: cancel checkbox relabeled to “Exclude manually cancelled orders from cron”.

8.1.9 – 03-06-2026

• Fix – Blocks checkout: validation errors no longer show a persistent PayPlus error popup; WooCommerce native inline notices are used instead.
• Fix – Blocks checkout: corrected set_payment_details calls to pass arrays instead of strings, preventing PHP foreach warnings.
• Fix – Hosted Fields: card number field now shows a green checkmark when card brand is detected.
• Fix – Hosted Fields: lock and CVV icons now use inline data URIs, eliminating CORS errors on local/dev environments.
• Fix – SEO: noindex meta tag for error page no longer incorrectly applied to other pages.

8.1.8 – 19-05-2026

• Feature – Invoice+ Documents: Added POS EMV to the “Do not create documents” exclusion list.
• Fix – Invoice+ Documents: POS EMV exclusion now works correctly (POS EMV orders are detected via transaction meta).
• Fix – Invoice+ Documents: Payment method detection now uses alternative_method_name (bit, apple-pay, google-pay) when available.
• Fix – Invoice+ Documents: Payment query is now HPOS-compatible (queries correct meta table on High-Performance Order Storage sites) – Fix for docs that came out as other instead of payment app.
• Fix – Payment meta is now fully stored before order save, preventing race conditions with automatic invoice creation hooks.

8.1.7 – 05-05-2026

• Fix – Resolved WC_Order_Item_Coupon::offsetGet deprecation notice (since WooCommerce 4.4.0) when coupons are applied at checkout.
• Feature – Refund fee: Option to automatic 5% or 100 NIS (whichever is lower) refund fee for PayPlus refunds.
• Feature – POS Only Mode option for dedicated POS terminal setups.
• Fix – Hide PayPlus Gateway checkbox now works reliably for all checkout types (Classic and Blocks), regardless of Hosted Fields or EMV configuration.
• Fix – Hosted Fields: resolved duplicate rendering issues on Blocks checkout.
• Fix – Subscriptions: token now correctly retrieved from subscription or parent order (ON ALL CASES).
• Fix – Blocks checkout: payment errors now display correctly to frontend users.
• Fix – Cron job no longer fires at order creation, only at scheduled intervals.
• Tweak – Optimized user_has_cap filter: now registers only once and only in admin, eliminating ~200ms overhead on every frontend request.

8.1.6 – 18-03-2026

• Fix – PayPlus payment gateway now displays correctly in the WooCommerce Blocks checkout page editor (resolved “payment methods not supported” message).
• Feature – Blocks checkout: closing a payment page (iframe/popup) or re-selecting a payment method no longer requires a full page reload.
• Fix – Blocks checkout: PayPlus Embedded (hosted fields) no longer requires a full page reload on payment failure or when coupons/gift cards change.
• Fix – Order status polling now stops correctly when a payment page is closed or the cart total changes (both Classic and Blocks checkout).
• Feature – J5 Weight Estimate: added a configurable percentage-based cart fee (5%–20%) for Authorization (J5) mode, visible only when a PayPlus gateway is selected.
• Feature – J5 Weight Estimate: customizable fee name and optional description message displayed below the fee line.
• Feature – New option to prevent double rendering of the payment page iframe on the receipt page (common with Elementor or other page builders).
• Tweak – Removed TV power-down effect feature.

8.1.5 – 15-03-2026

• Feature – Added VAT selection prompt for partial refunds, allowing admins to choose whether the refunded amount includes VAT or is VAT-exempt.
• Fix – Resolved an issue where saved payment tokens could override the PayPlus Embedded selection, causing the checkout to revert to a previously saved card instead of using newly entered card details.
• Fix – Fixed token saving failure when the optional “Name for Invoice” or “Alternative ID/VAT” fields were filled during PayPlus Embedded checkout.
• Feature – PRUID history tracking: all payment page request UIDs are now stored with timestamps, enabling recovery of orders where the UID changed. The “Get PayPlus Data” button shows a selection popup with a “Try All” option.
• Feature – Optional order total display inside PayPlus Embedded payment form for both Classic and Blocks checkout, with automatic updates on coupon/shipping changes.
• Tweak – Reduced checkout order-status polling frequency to prevent excessive server load on slower sites.
• Fix – Fixed Hebrew character corruption (appearing as raw Unicode escapes) in PayPlus API payloads for certain server configurations.
• Tweak – PRUID history is now used by the cron job and the Orders Validator for more reliable order status recovery.
• Fix – Fixed expiry field order in PayPlus Embedded for LTR locales.
• Fix – The “Include Apple Pay Script” setting now correctly loads the Apple Pay script on Blocks checkout for all iframe display modes.

8.1.4 – 10-03-2026

• Fix – Fixed an issue where redirect URLs after payment could be malformed (& converted to &), potentially causing broken thank-you page loads or missing order details.

See changelog for all versions.