Chris Klosowski

Hi @daanvandenbergh ,

Thank you for such a thorough report. You traced it exactly right: 3.7.1 replaced the old md5 invoice hash with an HMAC-based token, and links that carry the old hash no longer validate.

That part was intentional. We looked at accepting the legacy md5 hash for logged-in owners and admins, but any path that keeps the old format valid leaves a gap in the hardening we were doing, so we chose a clean cutover instead. Where we fell short is the changelog: it should have said plainly that invoice links in emails sent before 3.7.1 would stop working. I’m sorry about the support tickets that caused you. Calling out changes like this clearly is something we’re tightening up for future releases.

For anyone else who runs into this, invoices are still easy to reach with a current link:

• Customers who log in can open “View Invoice” from their purchase history or order history, and from the order receipt page.

• Admins can use the “View Invoice” action on the order in Downloads > Orders.

• Any email sent after updating includes the new link, so this only affects older emails.

Your snippet is a reasonable choice for your own store, since it only applies to logged-in owners and admins. Just keep in mind that it does accept the old hash again for those users, which is the trade-off we decided not to make in core.

Thanks again for taking the time to dig into this and write it up so clearly.

Chris

Hi there @rclilly,

Thanks for flagging this, and for taking steps to protect your site in the meantime. A firewall rule is a sensible precaution until the update is out.

We’re aware of the vulnerability and are treating it as a top priority. A security update fixing it is being released today.

Patchstack published this without first reporting it to us through responsible disclosure, so we didn’t have the chance to ship a fix before it became public. When issues are reported to us directly, we turn fixes around quickly, and we’re moving just as fast here.

We’ll update this thread as soon as the release is available. Once it is, please update right away. You can keep your Cloudflare rule in place too, if you’d like the extra layer.

Thanks for your patience.

@prouddaughter

EDD’s Captcha settings are only for the checkout page, and don’t directly support Buy Now buttons like the one you are using so you can just turn off the EDD Captcha for now by setting it to ‘None’.

As far as the other captcha plugin integration I am not sure what one you are using so I can’t give direct advice on it, but temporarily disabling that on the page where your buy now button is may help mitigate any incompatibilities to verify if that is what is stopping the purchase from going through.

You can run V2 and V3 on the same site, but not on the same page, as that would likely cause conflicts between the two captchas attempting to load on the site.

Hi @prouddaughter

Sorry to hear you are experiencing issues with the purchase process. I have a couple of follow up questions to see if I can help narrow down the cause.

1. Can you link me to the documentary you promoted so I can look over the process of purchasing? I found one called No Bridge Too far, is that the correct one?
2. If it is that one it looks like it is configured to use the Buy Now button instead of using the standard checkout flow, is that correct?
3. With the error about “No Captcha” do you have the captcha settings enabled in Downloads > Settings > Misc > CAPTCHA? If so what CAPTCHA system are they using, reCaptcha or Turnstile

You also mentioned that after clicking to purchase yourself it just sat there. If you can see if there is any entries in Downloads > Tools > Event Logging and select the “Payment Errors” logs that might give us a little more detail about what’s happening.

@aminnima2 thanks

That is a start. Is it possible to get the full stack trace that is mentioned in the message you provided? That might help us further identify the root cause

Our own site is running on PHP 8.x and our test and development sites are all running PHP 8.x versions, so at this point any additional information you can provide would be extremely helpful in resolving the issue for you faster.

@roboinstructor

By default, the download links have a 24 hours expiration. This can be changed to something more suitable for your users in Downloads > Settings > Misc > Download Link Expiration

By changing this setting to a higher number you’ll be changing the number of hours your download links last. You can read more about this setting here: https://easydigitaldownloads.com/docs/do-download-links-expire/

I hope that helps you ensure your customers are able to successfully download their products.

@wellness9

I do apologize for the confusion you are having.

You mentioned that you are using Easy Digital Downloads and based on the message you are using the version downloaded from WordPress.org for free. Correct?

You also mentioned that you seeing a message about our ‘Stripe Pro’ gateway, based on the message you are seeing of Easy Digital Downloads – Stripe Pro Payment Gateway Is Not Fully Activated!

The reason that we previously asked you to contact us directly via email is because you mentioned this message from our Stripe Pro gateway which is a paid upgrade, and it is not permitted to provide support for paid addons here on WordPress.org, and your initial message elludes to the fact that you are attempting to use one of our paid addons.

So please head to https://easydigitaldownloads.com/support, and below the chat window, click ‘No.’ for the “Was your question answered?” field. Then you can supply the necessary information to our team regarding the Stripe Pro Gateway, including the Site Health report which would give us some more insights into what’s happening with your site.

@fckwp4343,

Thank you for taking the time to share your concerns. I’d like to clarify how our Stripe integration works to ensure full transparency and understanding.

Our plugin uses Stripe Connect, a method encouraged by Stripe, to simplify the initial setup, ensure a properly configured integration for collecting payments, and provide a more secure integration flow. The only time our Stripe integration communicates with the Easy Digital Downloads website is during this initial connection process, using industry-standard OAuth 2.0 flows as outlined by Stripe in their recent changes to the Connect guidelines. Once this secure connection is established between your store and Stripe, all Stripe communication occurs directly between your store and Stripe—Easy Digital Downloads does not process, transmit, or store any transaction or customer details on our own servers at any time. We are not a middleman for the payments an Easy Digital Downloads-powered store processes.

Unlike many other developers integrating with Stripe, our approach ensures that communication with Stripe is not modified or altered, maintaining both security and reliability. We take security and privacy very seriously and follow industry best practices to protect both merchants and customers.

If you have any further questions or concerns, we’d be happy to discuss them—please feel free to reach out to our team directly.

Best regards,
Chris Klosowski
President, Easy Digital Downloads