ReCurr Pro — Release Notes

Customer-facing release history for ReCurr Pro. For technical details and the full per-commit changelog, see the developer changelog inside the plugin (recurr-pro/CHANGELOG.md).

These notes cover customer-visible releases — point releases that only ship internal cleanup or non-user-visible polish are intentionally omitted from this document but are still listed in the technical changelog.

---

Release Index

Version	Date	Theme	Highlights
3.0.13	10 October 2026	Stays Active Through a ReCurr Upload	ReCurr Pro no longer switches itself off when a ReCurr zip is uploaded; the Affiliate Programme page no longer needs a Permalinks save; the update notice clears after one update
3.0.12	27 September 2026	One Level Only, and PayFast Split Fixes	The referral programme is single-level by design; Block Checkout referrals are recorded; a commission larger than its payment is paid in full; renewal splits wait for PayFast’s confirmation
3.0.11	17 August 2026	Recurring Commissions & CRM Triggers Work	Affiliates now earn on renewals — they never have; five CRM automation triggers that had never fired now do
3.0.10	17 August 2026	Affiliate Commissions Corrected	PayFast Split paid and recorded the wrong amounts to the wrong people; commissions are now single-level
3.0.9	6 August 2026	Plan changes Take Effect	A downgrade away from Pro now actually switches CRM and Affiliate off
3.0.8	1 June 2026	Audit Remediation (Round 2)	Tracking-token, CSV, and fraud-window hardening; data-integrity fixes
3.0.7	29 May 2026	Audit Remediation (Round 1)	Critical PayFast Split commission-rate fix; affiliate + CRM hardening
3.0.6	12 May 2026	Critical Activation Fix	Resolves a fatal error on activation affecting 3.0.5 installs
3.0.5	17 April 2026	PayFast Partner Compliance	Inherits base ReCurr 2.4.7’s hardened PayFast ITN handler
3.0.4	14 April 2026	Security Hardening	Closed an open redirect, blocked SSRF in webhook actions
3.0.2	16 March 2026	Auto-Updates	One-click Pro updates via the WordPress dashboard
3.0.0	14 March 2026	Launch Release	Full CRM + Affiliate platform — first public release

3.0.13 — 10 October 2026

Stays Active Through a ReCurr Upload, and the Affiliate Programme Page Repairs Itself

Why this release matters: two faults that made ReCurr Pro quietly stop working after you installed a ReCurr update are fixed. Uploading a new ReCurr zip could switch ReCurr Pro off — and while it was off, no referrals or commissions were recorded, no PayFast Split payments were sent and the CRM stood still. And My Account → Affiliate Programme could show “Page not found” until you saved Settings → Permalinks. You no longer need to re-activate ReCurr Pro or save Permalinks after updating ReCurr.

What changed for you

Fixed — ReCurr Pro switched itself off when a ReCurr zip was uploaded

When you upload a new ReCurr zip (Plugins → Add New → Upload Plugin → Replace current with uploaded), WordPress keeps serving your site while it replaces ReCurr’s files. On a request that found ReCurr missing in that moment, ReCurr Pro deactivated itself, and none of it ran until you activated it again.

ReCurr Pro now stays active and waits on such a request, and loads again on the next one. If ReCurr is really missing or inactive, ReCurr Pro shows its notice on your admin screens instead of switching itself off. Activating ReCurr Pro without ReCurr is still refused. Updates made from Dashboard → Updates were never affected: WordPress puts the site into maintenance mode while it replaces the files.

Fixed — the Affiliate Programme page could answer “Page not found”

After ReCurr was updated or a new ReCurr zip was uploaded, and on a new install of ReCurr Pro, My Account → Affiliate Programme could answer “Page not found” until Settings → Permalinks was saved. WordPress keeps a stored list of your site’s page addresses and rebuilds it from whatever is registered at that moment; ReCurr Pro never rebuilt it itself, so a rebuild made while its page was not registered left the page out.

ReCurr Pro now checks that list on the front end of your site and, when its page is missing, rebuilds it once — in the database only, never your .htaccess file — so the first visit after the loss puts it back and the page opens on that visit. It also rebuilds the list once after each ReCurr Pro update. If something else on your site keeps removing the address, ReCurr Pro tries again at most once an hour instead of on every visit.

Fixed — the update notice clears after one update

With ReCurr 2.8.6 or later installed, ReCurr Pro’s update notice clears after one update. ReCurr runs the update check for both plugins; before 2.8.6 it could offer the version just installed again straight after an update.

What you’ll notice

• After uploading a ReCurr zip, ReCurr Pro is still Active on your Plugins screen.
• My Account → Affiliate Programme opens without a Permalinks save.
• If ReCurr is inactive, ReCurr Pro stays active and shows a notice asking for ReCurr, instead of disappearing from your active plugins.

Before you update

• If you uploaded a ReCurr zip recently, check that ReCurr Pro is still Active. If it was switched off, activate it again.
• Update ReCurr to 2.8.6 as well, so that from the next release on, each update notice clears after one update.

Who needs to update

Everyone. Promptly if you install ReCurr updates by uploading the zip, or if your affiliates use the Affiliate Programme page.

Compatibility

• No database change and no migration; commissions, referrals, payouts, PayFast Split and the CRM are unchanged. With plain permalinks nothing is checked or rebuilt.
• Pro 3.0.13 requires base ReCurr 2.3.0 or higher (enforced minimum); ReCurr 2.8.6 or later is recommended (the update notice above).
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.12 — 27 September 2026

One Level Only, and PayFast Split Fixes

Why this release matters: your affiliate programme now has exactly one level — your store, and the affiliates who refer its customers — and nothing in ReCurr Pro records, shows or could pay a chain of affiliates beneath that. No commission amount changes. The release also fixes two PayFast Split faults found while checking the split end to end, and changes one default: renewal commissions for affiliates on PayFast Split now go into your normal approve-and-pay-out queue until the renewal split has been confirmed with PayFast. If any of your affiliates is paid by PayFast Split, read Before you update.

What changed for you

Changed — one level, by design

Affiliates earn on the sales they refer, and nobody earns on anyone else’s. Commissions have worked this way since 3.0.10; this release removes what was left of any structure beneath it.

• Signing up through another affiliate’s link no longer links the two accounts. The link still credits that affiliate for anything the visitor buys, exactly as before.
• The affiliate portal no longer has a “Your Referred Affiliates” section. It listed other affiliates who had signed up through the viewer’s link, with their referral counts and their earnings.
• The affiliate tree is gone from your admin screens — its page, and its button on the Affiliates screen — and so is the “Recruited by” line on an affiliate’s page. Links recorded by earlier versions stay in your database, untouched, and are shown nowhere.
• Affiliate Reports no longer has a per-level performance section. The CSV export keeps all its columns, so your existing spreadsheets still line up; the level column reads 1 for every affiliate.
• Affiliate Settings reads “Single level — the referring affiliate only.”, and the licence page lists “Single-level referral programme: affiliates earn on the sales they refer”.

Fixed — a referral made through the Block Checkout was never recorded

On a store using the WooCommerce Block Checkout, a sale referred by an affiliate was never recorded as a commission. If that affiliate is paid by PayFast Split, PayFast still paid them their share at checkout — with nothing in ReCurr to show for it: no commission, and nothing flagging the payment. Affiliate coupons were not picked up on the Block Checkout at all, so those sales earned their affiliate nothing.

Referrals and affiliate coupons are now recorded on both the classic checkout and the Block Checkout. And when a split pays an affiliate from a link clicked after the order was placed (the customer paying later from the order’s payment page), the referral is written to the order, so the commission recorded always names the affiliate PayFast paid.

Orders placed before the update are not changed. If you use the Block Checkout and PayFast Split, compare your affiliates’ PayFast payments with their commissions in ReCurr.

Fixed — a commission larger than the payment was split short and recorded as paid in full

With a flat-rate programme on a small payment — a late-month pro-rata first payment on a low-priced plan, a first payment discounted to nothing, a small renewal — an affiliate’s commission can be more than the payment it comes from. PayFast Split then paid the affiliate only part of it, while ReCurr recorded the whole commission as paid. An affiliate owed R50.00 on a R17.93 first payment received R17.93, and the books said R50.00 had been paid.

Now no split is sent when the commission is more than the payment. The whole commission goes into your normal approve-and-pay-out queue and is paid in full, and a note on the order says why the split was withheld.

Changed — PayFast Split on renewals: off until PayFast confirms it

Renewal commissions for affiliates on PayFast Split now go into your normal approve-and-pay-out queue instead of being split on each renewal charge. They are recorded exactly as before, and are never marked paid until you pay them out. First payments are still split as before.

The reason is caution with your customers’ renewals. PayFast’s API documentation describes the security signature of the renewal charge differently from the signature of the checkout payment form, and ReCurr Pro sends the split instruction on renewals the way the payment form documents it. If PayFast checks it the other way, every renewal carrying a split would be refused — and your customer’s renewal would fall into dunning with nothing wrong with their card. Until a real PayFast renewal has shown an affiliate receiving the split, paying renewal commissions through your queue is the safe choice.

If you want renewal splits on before then, add this line with a code-snippets plugin or in your theme’s functions.php:

add_filter( 'crb_payfast_split_send_on_renewal', '__return_true' );

If a renewal carrying a split is then refused by PayFast, remove the line again.

Fixed — a saved commission programme could not be opened on PHP 8

On PHP 8, a commission programme could not be opened for editing once it had been saved — the screen stopped with an error. It opens again. This is a display fix only: nothing the screen saves has changed.

If a programme was set up before 3.0.10 with its own rate for the referring affiliate, that rate is still the one commissions are worked out at, and the programme screen now shows it under Rate in use. Until now the screen showed the base rate while commissions were worked out at the saved one. A rate per level can no longer be saved; any deeper rates an old programme carries stay in your database and are never read.

What you’ll notice

• The affiliate portal has no “Your Referred Affiliates” section; the Affiliates screen has no tree button; an affiliate’s page has no “Recruited by” line; Affiliate Reports has no per-level section.
• Affiliate Settings’ Commission Depth row reads “Single level — the referring affiliate only.”
• A programme carrying a rate saved by an earlier version shows Rate in use on its edit screen.
• A PayFast Split affiliate’s renewal commissions appear in your payout queue, where they used to be marked paid.
• Where a commission was larger than the payment, the order carries a note that the PayFast Split was withheld and the commission follows the normal approval and payout path.

Before you update

• If any affiliate is on PayFast Split with recurring commissions, their renewal commissions will arrive in your payout queue instead of their PayFast account. Tell them, and include those commissions in your payout runs.
• If you use the Block Checkout with affiliates, compare your affiliates’ PayFast payments with their commissions in ReCurr for orders placed before the update: a referred Block Checkout order may have been split with no commission recorded, and an affiliate coupon used there earned nothing.
• If you run a flat-rate programme with PayFast Split affiliates, look for commissions marked paid that are larger than the payment they came from. Before this release the affiliate received at most the payment amount; the difference is still owed and is on no payout. Nothing in this release changes records made before it.

Who needs to update

Everyone with the Affiliate module in use — promptly if your store uses the Block Checkout with affiliates, or pays affiliates by PayFast Split on a flat-rate programme.

Compatibility

• No database change and no migration. Links and rates recorded by earlier versions are kept, untouched.
• Renewal commissions need base ReCurr 2.7.16 or later, as in 3.0.11. Pro 3.0.12 requires base ReCurr 2.3.0 or higher (enforced minimum); running the latest base ReCurr is recommended.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.11 — 17 August 2026

Recurring Commissions & CRM Triggers Work

Why this release matters: two features you have been able to configure since launch have never actually done anything. Recurring affiliate commissions have never been paid — not for PayFast Split, not for EFT, not for anyone — and five CRM automation triggers have never fired, including “Payment Received” and “Payment Failed”. Both are fixed. If you have automations set up on those triggers, read Before you update below, because they will start running.

What changed for you

Fixed — affiliates have never earned on renewals

If you set a commission programme to pay recurring commissions, ReCurr recorded the initial sale and then never paid a cent on any renewal after it. Not once, for any affiliate, on any payment method. The recurring-commission setting, the renewal cap, and the rule that stops payments on a deactivated programme were all present on screen and unreachable in practice.

The cause was a plumbing fault: the affiliate module was listening for a renewal event that nothing ever sent. It now listens for the event ReCurr actually raises when a subscription payment completes.

Affiliates start earning on renewals from their next renewal. Past renewals are not backdated. That is deliberate — there is no way to establish after the fact what a historical renewal should have paid, and we will not write figures into your books that cannot be proven. If you want to compensate an affiliate for missed renewals, do it as a manual adjustment you can point at.

Fixed — affiliates on PayFast Split now receive their renewal commission at the gateway

For affiliates paid by PayFast Split, the split is now included on each renewal charge, so their renewal commission lands in their PayFast account the same way their initial commission does. We confirmed against PayFast’s developer documentation that the ad-hoc charge used for renewals accepts split instructions in its own right, and ReCurr now sends them on every charge rather than assuming an earlier instruction still applies.

A renewal commission is only ever marked as paid if the split was actually sent. If anything at all prevents it — the affiliate switched to EFT, their merchant ID is missing, the commission programme has been deactivated or has hit its renewal cap — the commission simply goes into your normal approve-and-pay-out queue instead, exactly like an EFT affiliate’s. It is never quietly written off as paid.

Fixed — five CRM automation triggers had never fired

Every one of these is offered when you build an automation, and none of them had ever run:

• Payment Received — and with it, payment entries on a contact’s activity timeline, and the automatic move of an at-risk contact back to active when they pay.
• Payment Failed — and the automatic move of a contact to at risk.
• Subscription Created and Trial Started — and the contact lifecycle move to active or trial on signup.
• Referral Made.

If you built an automation on any of these and wondered why it never ran, this is why. They will start running now.

One trigger is still inert: Trial Ending Soon. There is no underlying “trial is about to end” event in ReCurr for it to listen to, so unlike the others it cannot simply be reconnected — it needs building. It is on the list; until then, an automation on that trigger will not fire.

Fixed — customer lifetime value could have been counted twice

A side effect of reconnecting Payment Received: for subscriptions selling virtual or downloadable products, the same order’s value would have been added to a contact’s total spend twice, inflating lifetime value on every renewal. Each order is now counted exactly once no matter which path records it — including a case that could already double-count on rare occasions before this release.

Fixed — renewals are no longer treated as suspicious

The fraud checks that guard against a flood of conversions from one address were being applied to renewal charges. Because renewals are raised by a scheduled task and carry no customer address, a busy affiliate’s renewals would eventually all be grouped together and flagged. Renewals are no longer run through that check — they are recurring charges on a customer who was already vetted at signup. Self-referral detection and the blocked-address list still apply.

Before you update

• Review your automations. Anything built on Payment Received, Payment Failed, Subscription Created, Trial Started or Referral Made has been dormant and will begin running on the next matching event. Nothing is replayed against past events — no historical payment will trigger anything — but if one of those automations sends email, check that it still says what you want it to say.
• Expect renewal commissions on your next payout run. Affiliates on recurring programmes will start accruing. If you have been quoting affiliates a recurring rate, they are about to start receiving it.
• Requires base ReCurr 2.7.16 or later. There are no base plugin changes in this release — 2.7.16 already contains everything needed.

3.0.10 — 17 August 2026

Affiliate Commissions Corrected

Why this release matters: if you have any affiliate paid by PayFast Split, this release fixes real money going to the wrong place. Commissions were being credited to affiliates PayFast had never paid, some affiliates were credited twice, and the amount PayFast actually split was not the amount recorded as owed. Update, and read the two upgrade reports before your next payout run. If you don’t use PayFast Split, the affiliate changes still apply to you but nothing was mis-paid.

This release also makes the affiliate programme single-level — see below, as it changes what some affiliates earn going forward.

What changed for you

Fixed — split commissions were credited to the wrong affiliates

When a referred customer paid, PayFast split the commission to one account: the affiliate who made the referral. ReCurr then marked every commission on that order as paid — including the multi-tier upline affiliates who had received nothing. Their reported earnings doubled, and the money showed as a balance that could never actually be paid out: a commission marked “paid” is permanently excluded from the payout run, so it sat there forever, reconciling against nothing.

Only the affiliate PayFast actually paid is marked paid now. Everyone else’s commission stays in the normal approve-then-pay-out flow, where it belongs.

Fixed — some affiliates were credited twice

If you had set your commission holding period to 0 days, or you were using multi-tier commissions, the affiliate’s earnings were counted once when the commission was approved and again when the split marked it paid. They ended up with double the earnings and a positive balance, which put them on the “affiliates with a balance” list on the Payouts screen — where you could have paid them a second time for money PayFast had already sent.

Fixed — PayFast split a different amount from the one recorded

PayFast was given a percentage, which it applied to the full order total including VAT and shipping. The commission recorded in ReCurr was calculated on the item prices excluding VAT. On a R1,000 order plus 15% VAT at a 20% rate, PayFast paid the affiliate R172.50 while your books recorded R200.00 — and marked it paid.

Two related problems went with it: a basket mixing products on different commission rates was split at whichever rate happened to come first, and a fixed-amount commission created one commission per product line but only ever split one of them.

ReCurr now works out the exact rand amount owed and tells PayFast that figure directly. What the gateway pays and what your books record are now the same number. Cent rounding was also corrected — the old conversion truncated and lost up to a cent on every split.

Fixed — an affiliate could be paid before the fraud checks ran

The split was sent to PayFast at checkout, but the self-referral block, the fraud checks and the IP block list didn’t run until the order completed. By the time any of them said no, the money had already moved — and because no commission record was then created, there was no trace of the payment anywhere in ReCurr. An affiliate could buy through their own link and pay themselves in real time.

Those checks now run before the split is sent. For the few cases that genuinely can’t be decided until later — an affiliate suspended between checkout and completion, for instance — an order note and an admin flag are recorded, so a split paid without a matching commission is never invisible again.

Fixed — an invalid PayFast merchant ID was accepted silently

Entering a merchant ID with a space, dash or letter in it (say 12345 678) was quietly discarded while the screen said “saved”. The affiliate then selected PayFast Split, received nothing, and there was no way to find out why. Both the admin screen and the affiliate portal now reject the entry with a clear explanation, and nothing else on the form is saved either — so it’s obvious the save didn’t take.

Fixed — refunded orders now show their unrecoverable commissions

A commission paid instantly through PayFast Split can’t be clawed back when you refund the order — PayFast has already settled it. That hasn’t changed, and can’t. What has changed is that it’s no longer invisible: those commissions are flagged, noted on the order, and listed under Refunded orders with unrecoverable split commissions on the Affiliate Reports screen with a running total, so you can recover or offset the amount deliberately.

Improved — self-referrals are harder to slip through

Self-referral was only ever checked by WordPress user account, which a logged-out checkout or a second account walks straight past. The billing email is now checked against the affiliate’s account and payout email addresses, and the order IP against the affiliate’s own recorded address.

Affiliate commissions are now single-level

The affiliate who makes a referral earns on it. Nobody earns a second commission on a sale referred by someone they recruited. The “Maximum MLM Tiers” setting has been removed — this is now fixed and is no longer configurable.

Affiliates can still recruit each other, and who introduced whom is still recorded and shown on the renamed Affiliate Referral Tree. It simply doesn’t pay a second commission.

One thing to be aware of, because it changes what some affiliates earn. Under the old multi-tier default, an affiliate who signed up through another affiliate’s link was created at tier 2 — and a tier-2 affiliate only earns if you had explicitly configured a tier-2 rate on the commission programme, which few sites do. Those affiliates have been earning nothing at all on their own referrals, quietly, for as long as they’ve been signed up. The upgrade moves every one of them to the standard level, so they now earn your normal commission rate on referrals they make. Each one is listed in the upgrade report.

Nothing already earned or paid is altered. Existing commission records keep their recorded amounts exactly as they are.

What you’ll notice

• Two upgrade reports appear as a notice on the Affiliates screen the first time you visit it after updating. Read them before your next payout run. One lists the split commissions that were corrected automatically and any affiliate totals that need your judgement; the other lists affiliates moved to the standard commission level.
• The Affiliates list drops its “Tier” column, and the affiliate detail page shows Recruited by in place of “Tier Level”.
• The commission programme editor no longer offers multi-tier rate overrides. If a programme still carries some from before, they’re shown read-only and marked unused — nothing is deleted.

Who needs to update

Everyone with the Affiliate module in use, and urgently if any affiliate is paid by PayFast Split. Some totals may need correcting by hand afterwards — the upgrade tells you exactly which, and deliberately does not guess at figures it cannot prove.

Compatibility

• Pairs with base ReCurr 2.7.16, which adds a filter this release documents for future use. Pro 3.0.10 runs correctly against 2.7.15 as well.
• No database columns are added or changed. Two one-time data migrations run automatically on first load after updating.
• Pro 3.0.10 requires base ReCurr 2.3.0 or higher (enforced minimum). Running the latest base ReCurr is recommended.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

Known limitation

Recurring affiliate commissions on subscription renewals do not work and never have — for any payout method, not only PayFast Split. The internal event they depend on is never raised, so no renewal commission has ever been created. The fix is written but deliberately held back pending written confirmation from PayFast about how splits behave on recurring token charges: shipping it on an unverified assumption risks recording affiliates as paid on every renewal when no money has moved, which would be worse than the current situation of nothing happening at all. This is tracked and will land once PayFast confirms.

3.0.9 — 6 August 2026

Plan Changes Take Effect

Why this release matters: moving from Pro down to a lower plan revoked nothing at all — CRM and Affiliate stayed unlocked indefinitely on a site that had stopped paying for them. This release closes that, and makes a replaced licence key say so instead of continuing to report everything as fine. Recommended for everyone, and required if you sell or move between plans.

What changed for you

Fixed — a downgrade away from Pro revoked nothing

When a client moves from Pro to a lower plan, the licence server retires their Pro key and issues a new one. The licence check reports success for any key that exists, though — it never asked whether that key was still the current one — so the site went on validating the retired key every day and never re-checked which plan was being paid for. CRM and Affiliate stayed switched on for as long as nobody noticed.

The Pro modules are now gated on your entitlement as well as your licence being valid. When the licence server reports the key as replaced by a lower tier, CRM and Affiliate stop loading.

Nothing is deleted. Your contacts, affiliates, commission history and campaign data are all still there, exactly as they were, and come back the moment you move back up to Pro or enter the new key. A replacement at the same tier, or one whose tier the licence server doesn’t report, revokes nothing.

New — you’re told when your key has been replaced

A notice now appears on every admin screen, and on the licence page, when your key has been superseded — naming the plan it was replaced for and the last characters of the new key, so you can match it against the one emailed to you. The licence page shows Superseded in place of Active, with a Replaced By row. Previously it read “You are on ReCurr Pro. All features unlocked” while your plan said otherwise.

What you’ll notice

Nothing, unless your plan has changed. Your subscriptions keep billing as normal throughout — this plugin keeps loading, and your ReCurr licence is unaffected. What a downgrade takes away is CRM and Affiliate, and nothing else. That distinction is deliberate: a Pro-only client has no separate base key, so switching the licence off over a plan change would take their billing offline, which would be far worse than the problem being fixed.

Who needs to update

Everyone. No database changes, no configuration, and no effect at all on a site whose plan hasn’t changed.

Compatibility

• Needs the licence server updated to have anything to act on; against an older licence server this release changes nothing.
• Pro 3.0.9 requires base ReCurr 2.3.0 or higher (enforced minimum). Running the latest base ReCurr is recommended.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

---

3.0.8 — 1 June 2026

Audit Remediation Release (Round 2)

Why this release matters: This release completes ReCurr Pro’s internal security-audit programme. It implements the remaining audit items — the deferred email-tracking-token fix, plus a deep-dive review of the admin screens, the affiliate portal, and the licence/import tooling. None of these issues had been exploited; this is proactive hardening, plus a couple of useful reliability fixes. All Pro installs should update.

What changed for you

Security

• Email tracking links are now unguessable. Open- and click-tracking links carry a token that proves the link is genuine. Previously that token could, in principle, be reconstructed by someone who knew the recipient’s email address and the (sequential) message ID — letting them forge “opens” and “clicks” in your campaign stats. Each message now carries its own random secret, so tokens can’t be reproduced. Existing campaigns are unaffected — emails already in inboxes keep tracking correctly.
• CSV report exports are protected against spreadsheet formula injection. When you export an affiliate report and open it in Excel, LibreOffice or Google Sheets, a cell that begins with =, +, - or @ is normally treated as a live formula. A malicious affiliate could set their display name to a formula that would then run on your computer. Exported cells are now neutralised so they’re always treated as plain text.
• Affiliate fraud rate-limits can no longer be held open indefinitely. The “too many clicks / conversions from one IP” protection used a sliding time window that an attacker could keep open by spacing requests just under the limit. It’s now a true fixed window that closes on schedule.

Reliability & data integrity

• Contact CSV import now records the correct lifecycle stage. Previously the importer checked against an outdated list of stage names, so importing a contact as “Active” silently filed them as “Lead”. The importer now uses the live lifecycle-stage list, so imported contacts land in the stage you specified.
• Deleting an affiliate is now all-or-nothing. Removing an affiliate clears several related records (referrals, payouts, visits, etc.). These deletions now run as a single transaction, so a mid-way interruption can’t leave orphaned records behind.
• Smaller robustness fixes: referral-code generation is now bounded (can never loop indefinitely), the referral tracking cookie is set defensively so a theme that outputs early can’t cause a warning, and the PayFast Split feature no longer overwrites payment-setup data that another integration may have added.

What you’ll notice

Nothing visible day-to-day. Campaign tracking, affiliate commissions, payouts and CSV exports all behave exactly as before — they’re just more robust under the hood. Contact imports now file people in the right stage.

Upgrade note — one automatic database change

This release adds one small column to the email-log table to store the per-message tracking secret. It is applied automatically the first time you load the WordPress admin after updating — there’s nothing for you to run, and no existing data is changed or migrated.

Who needs to update

Everyone. It’s a security + reliability update with no behavioural downside.

Compatibility

• Pro 3.0.8 requires base ReCurr 2.3.0 or higher (enforced minimum). Running the latest base ReCurr is recommended.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.7 — 29 May 2026

Audit Remediation Release (Round 1)

Why this release matters: Following an internal security and correctness audit of the affiliate and CRM engines, this release fixes one important commission bug plus a batch of affiliate, payout, and CRM hardening. If you run the affiliate programme — especially with PayFast Split or tiered (MLM) commissions — you should update.

What changed for you

The headline fix — tiered PayFast Split commissions were paid at the wrong rate

If you use tiered commission rates and pay affiliates via PayFast Split, the amount actually split to the affiliate at checkout could be wrong — it could pay a fraction of what you configured (for example, the split came out at roughly 1% when you had set 20%). Your reports showed the correct figure, but the money sent via PayFast Split didn’t match.

The cause was that two parts of the code read your configured tier rate in two different ways. They now share a single rate-resolver, so the commission you configure is exactly what gets calculated and what gets split — they can no longer drift apart.

If you use PayFast Split with tiered rates, please review recent split payments after updating to confirm affiliates are now receiving the rate you intended.

Affiliate integrity

• MLM upline can’t pay the buyer. In a multi-tier setup, if a buyer happened to sit above the referring affiliate in the chain, they could previously earn commission on their own purchase. The buyer is now skipped anywhere in the upline.
• Failed payouts only affect their own affiliate. Marking a payout as failed now reverts only that affiliate’s commissions — never another affiliate’s.
• Split commission records are now exact and consistent, even under retries or simultaneous activity.

Security

• Referral attribution is harder to spoof. Visitor IP detection no longer trusts forwarded headers unless your site is explicitly behind a configured proxy/CDN — preventing fake referral visits and fraud-limit bypass.
• Cookieless attribution is more conservative — it now only matches within a 24-hour window and also checks the browser fingerprint, reducing mis-attribution on shared connections (mobile networks, offices).
• CRM email safety: merge tags (like a contact’s name) are now safely escaped in outgoing emails, and unsubscribe is a two-step confirm so automated email-security scanners can’t accidentally unsubscribe your contacts.

Reliability

• Payouts only ever mark genuinely approved commissions as paid, reconcile the payout total against the underlying commissions, and run inside a database transaction.
• PayFast merchant IDs are validated before they’re saved, so a typo can’t silently misroute a split.
• Renewal commissions are no longer paid on a commission programme you’ve deactivated (unless you opt in).

What you’ll notice

For most stores, nothing visible — these are correctness and security fixes. The exception is tiered PayFast Split users, who should see their splits land at the correct configured rate from this release onward.

Compatibility

• No database changes — safe drop-in upgrade.
• Pro 3.0.7 requires base ReCurr 2.3.0 or higher. WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+.

3.0.6 — 12 May 2026

Critical Activation Fix

Why this release matters: Version 3.0.5’s packaged build contained a fault that could cause a fatal error shortly after activation, taking the site down until the plugin was disabled. This release fixes that. If you are on 3.0.5, update immediately.

What changed for you

• The activation crash is fixed. A flaw in the previous build’s packaging step dropped some internal method definitions, so when a certain background feature (email tracking) first ran, the site would error out. The build process has been rebuilt and verified so all code is intact.
• No feature or data changes — this is purely a build-integrity fix. Everything you configured in 3.0.5 (or earlier) is preserved.

Who needs to update

Anyone running 3.0.5. Other versions were not affected, but updating is still recommended to stay current.

Compatibility

• Pro 3.0.6 requires base ReCurr 2.3.0 or higher. WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+.

3.0.5 — 17 April 2026

PayFast Partner Compliance Release

Why this release matters: This is the version-aligned counterpart to the base ReCurr 2.4.7 release that was submitted to PayFast for partner-programme review. It contains no Pro-specific functional changes — but if you run the affiliate engine with PayFast Split commissions, this version ensures your Pro install is in lockstep with the new PayFast handling in base ReCurr.

What changed for you

• Affiliate commission attribution remains fully reliable. The PayFast Split integration in Pro routes through the base plugin’s PayFast gateway, and that gateway was significantly hardened in 2.4.7. With Pro 3.0.5 + base 2.4.7, every affiliate commission you attribute is backed by the same payment-verification chain that PayFast itself reviews:

  • Order amounts are now cross-checked against the WooCommerce total (with a 0.01 tolerance for rand/cents float rounding) — protecting affiliate commissions from being credited on tampered or replayed payment notifications
  • The list of IP addresses that PayFast can send notifications from is cached for 12 hours and falls back to a stored list if PayFast’s DNS becomes temporarily unreachable, so your affiliate attributions don’t go missing during transient network glitches

• No Pro-side code changed. The Pro plugin’s affiliate split logic uses a filter (crb_payfast_payment_data) to inject the affiliate split JSON into PayFast’s payment submission. That filter still runs unchanged — but the gateway it filters into is now the hardened version.

Who needs to update

Everyone running ReCurr Pro with affiliates enabled and using PayFast Split. If you’re running Pro purely for the CRM (no affiliate commissions), this release is optional — but recommended for the version alignment.

Update order

Always update base ReCurr to 2.4.7 (or higher) first, then update Pro to 3.0.5. The WordPress dashboard will offer both updates at the same time — accept the base update first and let it complete before accepting the Pro update.

Compatibility

• Pro 3.0.5 requires base ReCurr 2.3.0 or higher (enforced minimum). For the security and PayFast hardening described above to take effect, base ReCurr 2.4.7 or higher is recommended.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.4 — 14 April 2026

Security Hardening Release

Why this release matters: This release closes two security issues that were identified during a routine third-party security audit. Neither issue had been exploited in the wild — but both were the kind of “looks fine until it isn’t” problems that we want to fix proactively. All Pro installs should update.

What changed for you

1. Email click-tracking links are now tamper-proof

If you send marketing campaigns via the CRM, each link in your email is wrapped in a tracking URL so we can show you click-through stats. Previously, the destination URL (url= parameter) inside the tracking link wasn’t bound to the link’s signature — meaning a sufficiently determined attacker could swap the destination for a phishing site while keeping a valid-looking signature.

After 3.0.4, the destination URL is included in the signature itself. If the URL is changed, the signature breaks and the redirect is rejected. Your campaign stats are unaffected — this is purely a defence against link tampering by external parties.

What you’ll notice: Nothing visible. Existing campaign tracking links continue to work; new campaigns use the stronger signature automatically.

2. Webhook automation actions can no longer reach internal addresses

ReCurr Pro’s automation engine includes a “Send Webhook” action — useful for pushing CRM events into external services like Zapier, Make, or your own systems. Before 3.0.4, this action would happily POST to any URL, including addresses on your own server’s internal network (127.0.0.1, 10.x, 192.168.x, etc.).

This is a class of vulnerability called Server-Side Request Forgery (SSRF). After 3.0.4, the webhook action checks the destination IP and blocks any request that targets:

• Loopback addresses (127.0.0.0/8, ::1)
• Private networks (10/8, 172.16/12, 192.168/16)
• Link-local addresses (169.254/16, fe80::/10)
• IPv6 private space (fc00::/7)

If your destination DNS lookup fails, the request now fails closed (rejected) rather than fail open (sent anyway).

What you’ll notice: If you’ve been pointing a webhook at an internal address (very unlikely — most users send to public services like Zapier), you’ll need to expose that endpoint publicly or use a reverse proxy. For everyone else, no change in behaviour.

3. Licence page hardening

Small WordPress hygiene fix — the licence page nonce is now correctly unwrapped before verification. No exploit existed; this brings the licence page in line with WordPress core best practices.

Who needs to update

Everyone. This is a no-brainer security update.

Compatibility

• Pro 3.0.4 requires base ReCurr 2.3.0 or higher (enforced minimum). Base ReCurr 2.4.6 or higher is recommended for the matching security release on the base side.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.2 — 16 March 2026

Auto-Updates Release

Why this release matters: Before 3.0.2, updating ReCurr Pro meant downloading a new zip from your account, deleting the installed plugin, and uploading the new version manually — and you had to remember to check for updates yourself. From 3.0.2 onwards, ReCurr Pro behaves like every other WordPress plugin: when there’s a new version, you’ll see it in Dashboard → Updates and can update with one click.

What changed for you

1. One-click updates from the WordPress dashboard

The WordPress update system now knows about ReCurr Pro. When we ship a new version:

1. Within 12 hours, the new version appears in Dashboard → Updates (or sooner if you click Check Again)
2. The plugin’s row in Plugins → Installed Plugins shows an Update Now link
3. Click Update Now — the new version downloads, installs, and activates automatically

You’ll also see the standard WordPress View version X.Y.Z details link, which opens a modal showing the changelog (the same notes you’re reading now, in summary form) before you commit to updating.

2. Licence-gated downloads

Auto-updates are tied to your licence. The download link is signed with a short-lived signature that’s only valid for the domain your licence is registered against. If your licence has lapsed or been deactivated, the Update Now click will show a clear error message rather than silently failing.

This means:

• You always get the latest version as long as your subscription is active
• Lapsed installs continue running the version they were on but stop receiving updates
• Renewing your licence immediately re-enables updates (no plugin reinstall needed)

3. Purchase link cleanup

Small cosmetic fix — the Purchase ReCurr Pro link on the licence page (visible when no licence is entered) now points to the correct cyberdummies.co.za/recurr URL rather than a placeholder.

Who needs to update

Everyone who wants automatic updates from this point forward. You’ll need to update to 3.0.2 manually one last time (download from My Account → Downloads, upload via Plugins → Add New). After that, every future update is one click.

Compatibility

• Pro 3.0.2 requires base ReCurr 2.3.0 or higher (enforced minimum). For auto-updates to function end-to-end, base ReCurr 2.4.1 or higher is required — that release shipped the matching update endpoint that Pro 3.0.2 calls.
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+

3.0.0 — 14 March 2026

Launch Release — CRM & Affiliate Platform

Why this release matters: This is the first public release of ReCurr Pro. It transforms ReCurr from “a plugin that bills your customers” into “a plugin that manages your relationship with them” — adding a full CRM, marketing automation, email campaigns, and a complete affiliate / referral platform.

The launch release is a single, comprehensive bundle. There’s a lot here — the sections below break it down by feature area.

CRM — Customer Relationship Management

Pro adds a real CRM, sitting alongside your subscription data and synced automatically from your WooCommerce customers and ReCurr subscriptions.

Contacts

Every customer becomes a Contact with a rich profile:

• Lifecycle stage (Lead, Customer, Active Subscriber, At Risk, Churned — fully customisable)
• Tags (with colours, used for segmentation)
• Custom fields (add unlimited fields specific to your business)
• Activity log (every email, payment, subscription change, and admin note appears in chronological order)
• Inline notes (your team can add timestamped notes from the contact view page)
• Automatic sync from WooCommerce orders and ReCurr subscription events

Tags & Segments

• Tags are simple labels you attach to contacts (e.g., vip, cape-town, high-value)
• Segments are dynamic — they’re queries against your contacts (e.g., “all Active Subscribers in Gauteng tagged ‘vip'”) that re-evaluate every time you use them, so they’re always current
• Segments support 9 fields and 10 operators (equals, contains, greater-than, in-list, is-empty, etc.) and can combine multiple tag conditions

Tasks

A simple task system to remind your team to follow up:

• Tasks linked to contacts (e.g., “Call Janet about renewal” attached to Janet’s contact record)
• Status (open / completed), type, priority, assigned-to (any WP admin user), due date
• Filters by overdue, due-this-week, assigned-to-me, etc.
• Bulk actions (complete multiple tasks at once)

Email Campaigns

Send marketing emails directly from WordPress, targeted by your CRM data.

• Targeting: Send to a segment, a tag, or all contacts
• Editor: Familiar WordPress TinyMCE editor with merge tag support
• 13 built-in merge tags — {first_name}, {subscription_status}, {next_renewal_date}, etc., plus an extensible filter for adding your own
• Test send — preview the merged email to your own inbox before going live
• Scheduling — send now, or schedule for a future date/time
• Stats — opens (deduplicated per recipient), clicks (deduplicated per recipient), unsubscribes
• POPIA / GDPR-compliant unsubscribe — every campaign email includes a one-click unsubscribe link that updates the contact’s preferences instantly

Marketing Automation

Trigger actions automatically when contact events happen.

• 18 trigger types — contact created, lifecycle stage changed, tag added/removed, subscription created, subscription renewed, payment failed, contact inactive for X days, custom field changed, and more
• 10 action types — add tag, remove tag, change lifecycle, send email (single template), apply WooCommerce coupon, create task, add note, send webhook, wait (delays the next action by minutes/hours/days), trigger another automation
• Conditional execution — actions only run if conditions match (e.g., “only if contact lifecycle = Active Subscriber”)
• Sequential or branching — chain actions, with a wait action that suspends and resumes via cron
• Built-in deduplication — the same automation won’t fire twice for the same contact within an hour, preventing accidental email storms
• Daily inactivity check — automatically detects contacts inactive longer than your configured threshold

Affiliate / Referral Platform

A complete affiliate engine — your customers can refer others and earn commissions on the resulting subscriptions.

Affiliates

• Public registration via My Account — customers can apply directly from their My Account → Affiliate area (endpoint: /my-account/crb-affiliate/)
• Approval flow — applications go to Pending; admin approves, suspends, rejects, or reactivates
• Unique referral codes — generated automatically using cryptographic randomness over an unambiguous character set (no 0/O or 1/l confusion)
• Multi-level marketing (MLM) support — up to 5 tier levels, with parent-affiliate linkage so referrers earn from their downline as well
• Per-affiliate stats — balance, total earned, total paid, referral count, recent activity

Commission Programs

• Configure commission rates by product, category, or set a default rate that applies to everything
• Recurring or one-time — choose whether to pay commission only on the first sale or on every subsequent renewal as well
• Recurring limit — cap how many renewals an affiliate earns from (e.g., first 12 renewals only, or unlimited)
• Cookie days — how long an affiliate’s referral cookie stays valid after a click
• Tier rate overrides — set different commission percentages for each MLM tier level

Referral Tracking

• Click capture — ?ref=CODE URLs set a cookie and log the visit
• Survives the checkout — referral attribution is saved to the WC order at creation, so it works correctly even when payment confirmation arrives asynchronously via PayFast ITN
• Per-line-item commission — each cart item is calculated independently, so a cart with mixed products gets correctly split commissions
• MLM cascade — when a sale converts, commissions are automatically calculated up the affiliate’s parent chain
• Refund handling — if an order is refunded or cancelled, the related referrals are reversed automatically

Payouts

• Bundle approved referrals into payouts — group all approved commissions for an affiliate into a single payout record
• “Pay All Approved” convenience action — one click to create a payout for an affiliate’s full balance
• Minimum payout threshold — configurable per affiliate or globally; small balances roll over until threshold is met
• PayFast Split — optional automatic commission payment via PayFast Split at the time of sale (rather than batch payouts later)
• Status tracking — Pending → Processing → Completed (with reference) or Failed (which reverses to approved + credits balance back)

Affiliate Portal

A dedicated tab inside the customer’s My Account area for affiliates:

• Stats overview — balance, total earned, total paid, referral count
• Personal referral link with one-click copy
• Payment settings (bank details for payouts)
• Recent referrals table
• Payout history
• Creatives library (banners, text links, email swipes — pre-rendered with the affiliate’s referral code substituted in)
• MLM downline view (direct sub-affiliates with email obfuscated for privacy)

Fraud Detection

Built-in protections against common affiliate fraud patterns:

• Self-referral detection — affiliates can’t earn commissions on their own purchases
• Duplicate-order detection — the same order can’t generate multiple commissions
• Click-rate limiting — IPs that exceed the maximum clicks per hour have their cookies blocked
• Conversion-rate limiting — IPs that exceed the maximum conversions per 24 hours are blocked from generating new referrals
• Manual blocklist — flag specific IPs as blocked
• Audit trail — fraud reasons stored as order metadata for admin review

Reports & Analytics

A unified reports dashboard at ReCurr Pro → Reports:

• MRR — Monthly Recurring Revenue chart with month-over-month comparison
• Churn — churn percentage chart with active/churned breakdown
• Customer LTV — average lifetime value across cohorts
• Subscription growth — active subscriptions over time
• Revenue by product — per-product revenue breakdown
• Affiliate performance — top affiliates by referrals, conversions, and revenue generated
• CSV export — every report can be downloaded for further analysis

Dashboard Widget

A compact CRM stats widget for the WordPress Dashboard — at a glance, you see your contact count, segment counts, recent activity, and pending tasks.

Compatibility

• Requires base ReCurr 2.3.0 or higher (this is the enforced minimum across all Pro 3.x releases)
• WordPress 5.8+, WooCommerce 5.0+, PHP 7.4+
• Database tables (18 new) created automatically on activation

Stay Informed About New Releases

ReCurr Pro is in active development. New releases are announced via:

• In-dashboard updates — when a new version is available, you’ll see it under Dashboard → Updates in WordPress (auto-update support added in 3.0.2)
• Email — release announcements go out to the address on your CyberDummies account
• Support page — recent releases are listed at cyberdummies.co.za/recurr-pro

Have a feature request or want to influence the roadmap? Email us at [email protected] — customer feedback drives what gets built next.

---

Contact & Licensing

Licence Information

• Licence Type: Proprietary — see LICENSE.txt
• Usage: Licensed for use on your own sites while your licence is active; redistribution and resale are not permitted (see LICENSE.txt for full terms)
• Updates: Included with active licence
• Support: Included with active licence

A RECPRO- licence key authorises both plugins simultaneously — base ReCurr (all Plus features) and the ReCurr Pro plugin. One key, one bill.

Purchase & Renewals

• Purchase: https://cyberdummies.co.za/recurr-pro/
• Pricing: R349/mo (Pro tier)
• Licence Activation: Automatic upon purchase
• Renewal: Monthly subscription for continued updates and support

Support

• Email: [email protected]
• Hours: Monday – Thursday, 9:00 AM – 4:00 PM SAST; Friday, 9:00 AM – 12:00 PM SAST
• Response Time: Within 24 business hours (usually much sooner)

---

ReCurr Pro is built and maintained by CyberDummies — South Africa’s subscription billing specialists. Support: [email protected] | Documentation: cyberdummies.co.za/recurr-pro