Solidgate Card Payments and Other for WooCommerce

Solidgate Card Payments and Other for WooCommerce integrates the Solidgate payment platform into your WooCommerce store with support for card payments and a range of alternative payment methods (APMs). Card Payments

• Solidgate Card (sg_card) — An inline card form powered by the Solidgate Payment Form SDK. Card details are entered directly on your checkout page inside a secure Solidgate-hosted iframe. Supports 3-D Secure, refunds, and async webhook confirmation.

Alternative Payment Methods

• MB WAY (sg_mbway) — Push-notification payments for Portugal. The customer enters their MB WAY phone number and approves the payment on their MB WAY app. Available for EUR orders to Portuguese billing addresses.
• Bizum (sg_bizum) — Mobile payments for Spain. The customer is redirected to Bizum's hosted page and returns to your site after approval. Available for EUR orders to Spanish billing addresses.
• BLIK (sg_blik) — One-click payments for Poland. The customer enters a 6-digit BLIK code from their banking app. Available for PLN orders to Polish billing addresses.
• iDEAL (sg_ideal) — Bank transfer payments for the Netherlands. Available for EUR orders to Dutch billing addresses.
• Pay by Bank (sg_openbanking) — Open Banking payments available across supported regions.

All payment methods share a single admin plugin, one REST namespace (solidgate/v1), and a unified webhook setup. Webhook URL All payment methods share a single webhook endpoint. Configure this URL in Solidgate Hub (Settings → Webhooks): https://yoursite.com/wp-json/solidgate/v1/webhook The plugin automatically identifies which gateway a webhook belongs to by trying each configured key pair in turn. Requirements

• WooCommerce 6.0 or higher
• A Solidgate merchant account
• API keys from Solidgate Hub (separate keys for Card vs APM gateways)
• PHP 7.4+

1.0.5

• Security: webhook routing now extracts the order_id prefix from the raw request body via regex rather than from parsed JSON, eliminating the possibility of routing decisions being influenced by attacker-controlled input before signature verification.
• Security: APM webhook handlers (MB WAY, BLIK, Bizum, iDEAL, Open Banking) now deduplicate by Solidgate event-ID using a transient, the same guard already in place for the Card webhook handler. Duplicate webhook retries from Solidgate are acknowledged and discarded without re-processing.
• Security: card payment init token is now bound to the WC session customer ID. A token created in one browser session cannot be replayed by a different session.

1.0.4

• Fix: Hub-initiated refunds (via Solidgate dashboard) now correctly create a WC refund record — previously the order status flipped to "refunded" but no refund amount was recorded in WooCommerce accounting or order history.
• Fix: Added duplicate refund submission guard for BLIK, Bizum, iDEAL, and Open Banking — submitting a second refund while one is already awaiting webhook confirmation now returns an error instead of sending a second API call.
• Fix: Duplicate webhook protection for Hub-initiated refunds via _sg_processed_refund_ids order meta — a second webhook for the same refund transaction no longer creates a duplicate WC refund record.

1.0.3

• Security: card payment init and update endpoints now always read amount/currency from the server-side WC cart — client-provided values are ignored to prevent price manipulation.

1.0.2

• Renamed plugin display name to "Solidgate Card Payments and Other for WooCommerce".

1.0.1

• Security: poll-status REST endpoints now require order_key for order enumeration protection.
• Compliance: added == External Services == section documenting Solidgate API usage.
• Compliance: text domain and class prefix updated for WordPress.org submission requirements.

1.0.0

• Initial release — unified plugin combining Card, MB WAY, Bizum, BLIK, iDEAL, and Pay by Bank gateways.
• REST namespace: solidgate/v1.
• HPOS (High-Performance Order Storage) compatible.