#1513 Fix - Reject replayed Stripe PaymentIntents on membership renewal

modules/membership/includes/Admin/Services/Stripe/StripeService.php

@@ -1,4 +1,4 @@
 <?php
 
 namespace WPEverest\URMembership\Admin\Services\Stripe;
 
@@ -50,7 +50,7 @@
 
 	/**
 	 * Construct.
 	 */
 	public function __construct() {
 
 		// Initialize necessary repositories.
@@ -534,7 +534,7 @@
 			'type' => $membership_type,
 		);
 
 		if ( isset( $payment_data['upgrade'] ) && $payment_data['upgrade'] ) {
 			// $amount already holds the resolved (and converted) chargeable_amount — nothing to do.
 		} elseif ( isset( $payment_data['coupon'] ) && ! empty( $payment_data['coupon'] ) && ur_check_module_activation( 'coupon' ) ) {
 			$coupon_service    = new CouponService();
@@ -749,13 +749,13 @@
 	 * @param array       $response    Base response array.
 	 * @param string      $message     User-facing error message.
 	 * @param string|null $log_message Optional. Message for PaymentGatewayLogging::log_error.
 	 * @param array       $log_context Optional. Context for log
 	 * @return array
 	 */
 	private function update_order_error( array $response, $message, $log_message = null, $log_context = array() ) {
 		$response['status']  = false;
 		$response['message'] = $message;
 		if ( $log_message !== null && $log_message !== '' ) {
 			PaymentGatewayLogging::log_error( 'stripe', $log_message, $log_context );
 		}
 		return $response;
@@ -923,9 +923,9 @@
 					'payment_method' => $latest_order['payment_method'],
 				)
 			);
 			$response['status']  = false;
 			$response['message'] = __( 'Invalid payment method for this order.', 'user-registration' );
 			return $response;
 		}
 
 		// Exclude the order that actually owns this transaction (already fetched above), not the
@@ -1015,6 +1015,25 @@
 		} elseif ( 'succeeded' === $payment_status ) {
 			$member_order = $this->members_orders_repository->get_member_orders( $member_id );
 
+			// The retrieved PaymentIntent must belong to the order being completed. Verification runs
+			// against the order that owns the transaction while completion applies to the member's newest
+			// order; without this guard a succeeded PaymentIntent from an earlier order can be replayed to
+			// complete a newer pending order, renewing/extending a membership with no new payment.
+			if ( empty( $member_order ) || (int) $latest_order['ID'] !== (int) $member_order['ID'] ) {
+				return $this->update_order_error(
+					$response,
+					__( 'Payment verification failed.', 'user-registration' ),
+					'Payment confirmation rejected: PaymentIntent does not belong to the order being completed',
+					array(
+						'error_code'        => 'PAYMENT_INTENT_ORDER_MISMATCH',
+						'member_id'         => $member_id,
+						'payment_intent_id' => $pi_id,
+						'verified_order_id' => $latest_order['ID'],
+						'target_order_id'   => $member_order['ID'] ?? 0,
+					)
+				);
+			}
+
 			if ( 'completed' === $member_order['status'] ) {
 				$response['message'] = $is_upgrading ? __( 'Membership upgraded successfully.', 'user-registration' ) : get_option( 'user_registration_successful_membership_creation_message', esc_html__( 'New member has been successfully created.', 'user-registration' ) );
 				$response['status']  = true;
@@ -1039,7 +1058,7 @@
 					$member_subscription['ID'],
 					array(
 						'status'     => 'active',
 						'start_date' => date( 'Y-m-d 00:00:00' ),
 					)
 				);
 
@@ -1103,7 +1122,7 @@
 		return $response;
 	}
 
 	/**
 	 * Sends an email.
 	 *
 	 * @param int   $id                 The ID of the order.
@@ -1377,7 +1396,7 @@
 					&& ( 0.0 === round( max( 0, $plan_amount - $discount ), 2 ) );
 
 				if ( $is_zeroed ) {
 					$start_ts      = ( new \DateTime( "+ {$subscription_value} {$subscription_duration}" ) )->getTimestamp();
 
 					// UR-4386: the price above came from the discounted order total (0) => a $0 recurring
 					// price for local-currency / missing-price subs. Re-resolve against the FULL amount.
@@ -1411,7 +1430,7 @@
 
 					// Single open-ended phase starting one billing period in the future: nothing is
 					// charged until start_date, then the plan bills at full price indefinitely.
 					$phase         = array(
 						'items' => array(
 							array( 'price' => $effective_price_id ),
 						),
@@ -1459,8 +1478,8 @@
 							'status'         => 'pending',
 							'latest_invoice' => array( 'payment_intent' => null ),
 						);
 						$response['message'] = __( 'Registration complete, but the subscription could not be scheduled yet. Your membership is pending.', 'user-registration' );
 						$response['status']  = true;
 
 						return $response;
 					}
@@ -1506,8 +1525,8 @@
 						'schedule'       => $schedule->id,
 						'latest_invoice' => array( 'payment_intent' => null ),
 					);
 					$response['message'] = __( 'New member has been successfully created. The subscription is scheduled to start after the free coupon period.', 'user-registration' );
 					$response['status']  = true;
 
 					return $response;
 				}
@@ -3460,7 +3479,7 @@
 						'orders_meta_data' => array(
 							array(
 								'meta_key'   => 'is_admin_created',
 								'meta_value' => false,
 							),
 						),
 					);