Improved Payment Failure Logging

⚠️ Security release — update as soon as possible

This release fixes a vulnerability that allowed invoices to be marked paid without a completed payment. All previous versions are affected, including v1.0.1. Every WHMCS store using this gateway should update.

Required after updating

1. Upload both files, replacing the existing ones:
   • modules/gateways/paymento.php
   • modules/gateways/callback/paymento.php
2. Go to Setup → Payment Gateways → Manage Existing Gateways, then Save Changes on Paymento — even if you change nothing.

Step 2 is required, not optional. It re-registers your IPN URL with Paymento. If your WHMCS is installed in a subdirectory, the URL registered by earlier versions was wrong and payment notifications were never reaching your store.

Note: the gateway will now refuse to save unless both the API Key and the Secret Key are filled in. The Secret Key is what authenticates payment notifications — a blank one is why some stores silently received none.

Security

• Invoice settlement now requires confirmation from the Paymento API. Payment status is no longer taken from request parameters.
• Payments are bound to the invoice they were created for, so a token for one invoice cannot settle another.
• The credited amount comes from the verified API response and is never left blank.
• Duplicate and replayed notifications can no longer credit an invoice more than once.
• Invoices placed through other gateways are no longer touched.
• cURL requests now set explicit timeouts and TLS certificate verification.

Fixed

• Payment notifications were rejected on some servers. The IPN signature header was matched against two hardcoded spellings; getallheaders() normalises header case differently depending on the PHP SAPI, so valid notifications failed on Apache mod_php. Now matched case-insensitively.
• IPN URL was wrong on subdirectory installs. It was built from $_SERVER['HTTP_HOST'] assuming the document root. Now derived from your configured SystemURL.
• Invoice lookups could fail outright on some WHMCS versions due to a column that does not exist in every schema.
• A late or replayed rejection could move a paid invoice back to unpaid.

Changed

• Every callback outcome is now recorded in Billing → Gateway Log, including the underlying error when something fails. If you are troubleshooting, start there, an empty log means the request never reached your store.
• The customer return page distinguishes "paid" from "payment received, awaiting confirmation" instead of implying success either way.

Requires: WHMCS 7.0+, PHP 7.2+

Changelog – Version 1.0.0 ?

Initial Release

✅ First stable release of the Paymento Crypto Payment Gateway for WHMCS ✅ Supports Bitcoin, Ethereum, USDT (ERC20 & TRC20), and more ✅ Non-custodial payments – Receive funds directly to your wallet ✅ Automatic payment verification for seamless transactions ✅ Pending payment status support to handle unconfirmed transactions ✅ Easy installation & configuration within WHMCS ✅ Compatible with WHMCS v8.x (tested on latest version) - Tested on WHMCS v8.x. Compatibility with older versions (v7.x) is unconfirmed but likely to work.