[bajoski34]

• [SECURITY] Authenticate the payment callback (?wc-api=flw_wc_payment_gateway) against the order key. The endpoint previously accepted any order ID, so an unauthenticated request could cancel or fail arbitrary pending orders (CWE-288 / CWE-306).
• [SECURITY] Confirm a cancellation with Flutterwave before changing an order. A client-supplied status=cancelled no longer moves an order on its own.
• [SECURITY] Bind each callback to a transaction reference this store issued for that order, so a reference from another order cannot be replayed.
• [SECURITY] Ignore callbacks for orders that are no longer awaiting payment, making repeat callbacks inert.
• [SECURITY] Compare the webhook verif-hash with hash_equals(), and reject webhooks when no secret hash is configured.
• [SECURITY] Reject replayed webhooks by recording the Flutterwave transaction id already processed for an order (CWE-294).
• [SECURITY] Encrypt the stored Flutterwave card token at rest instead of keeping it as plaintext order meta.
• [SECURITY] Stop writing the full webhook body, which contains customer PII, to the WooCommerce log unless logging is explicitly enabled.
• [SECURITY] Scope checkout nonces to the order they belong to rather than validating against the default action.
• [SECURITY] Orders with no recorded transaction reference now only accept a reference issued in that order's name (WOOC_<order id>_…), rather than any reference.
• [FIXED] Preserve callback parameters on stores using plain permalinks, where the return URL previously lost them.
• [FIXED] Store order metadata through the CRUD API so transaction references and payment tokens work under HPOS.
• [FIXED] Correct the plugin header, which declared a WooCommerce floor above its own "tested up to" version.
• [FIXED] A successful Flutterwave charge that completes after its order was cancelled now reopens the order (after confirming the charge with Flutterwave) instead of being rejected as "Order already processed", which left customers charged with nothing fulfilled.
• [CHANGED] Update the JavaScript and PHP toolchains; the build now requires Node 24.
• [REMOVED] Unreferenced express-checkout scaffolding (client/blocks/payment-request/) and the unused flutterwave-react-v3, gridicons and @automattic/interpolate-components dependencies, which pulled a vulnerable axios into the dependency tree without reaching the build.