Release Notes

Updated November 5, 2026 3 min read

Security

Security: the checkout auto-login after a Paddle purchase no longer signs in an existing WordPress account by e-mail match; existing customers receive a one-click login link by e-mail instead, and privileged accounts are never signed in through checkout or magic links.
Security: checkout handoff tokens are generated per click in the browser and bound to the buyer's session, so a cached pricing page cannot leak a shared token.
Magic-login requests from the customer portal are rate-limited per address and per e-mail.
Unsigned webhook posts with an invalid body are rate-limited and no longer fill the webhook log.
Release upload rejects version strings that are not valid file-name characters.

Changed

Rate limiting can use the proxy-supplied client address (license_cart_client_ip filter), and the licensing and update-check endpoints are limited per address and license key, so customers behind one proxy no longer share a quota.
The checkout handoff stays valid for 30 minutes after payment (was 6 hours).
Deleting a license from License Cart → Licenses now revokes it (key stops working, activations cleared) instead of removing the row; the button reads "Revoke".
Uninstalling the plugin also removes its StoreEngine license activation data.

Fixed

A paid transaction whose items are not mapped to a package is logged as failed in License Cart → Logs and the store owner is e-mailed, instead of being logged as a successful purchase with no license.
The customer portal tells a returning customer to use the e-mailed login link instead of waiting on the "Preparing Your License" screen.

First paid release, sold through StoreEngine on technoleet.dev.

New

Paddle Billing v2 checkout button ([lc_buy_button]) and signed webhook handling that issues, renews, pauses and cancels licenses.
Licensing REST API (activate, deactivate, status, update/check) with domain-bound activations, row locking and rate limiting.
Private release uploads with signed, five-minute download URLs.
Magic-link customer portal ([lc_portal]).
Admin dashboard for products, pricing packages, licenses, customers, releases, webhook logs and settings.
Cloudflare R2 backup and restore.
Developer integration prompts, client SDK template and read-only MCP server.
StoreEngine License SDK for license activation and automatic updates of License Cart itself; License screen under License Cart → License.
Translation template (languages/license-cart.pot).

Fixed

Customer portal listed no licenses on fresh installs.
Uninstall left the prices and webhook-log tables, the portal page, uploaded releases and transients behind.
Release-record migration ran before the updates table existed.
Live Paddle webhooks were rejected while the environment switch was still on Sandbox; failed signatures can no longer flood the log table.
Every subscriber account was redirected away from wp-admin; now only License Cart customers are (filter license_cart_redirect_customers_from_admin).
Each rendered buy button wrote its own checkout transient; one per request is used now.

Changed

Was this article helpful?