Cognitcxt AI Chat Assistant for WooCommerce

Changelog

2.3.3

• Security: Re-activating a license on a different domain now requires the activation token issued at the original activation, instead of trusting client-supplied origin headers. A leaked license key can no longer be activated on an unauthorized domain, which would repoint the assistant at a store the attacker controls.
• Security: A “License domain changed” email is now sent to the account email address whenever a license moves to a new domain, so an unauthorized re-bind is visible to the store owner.
• Fix: Every activation call (automatic re-activation, the Activate button, adding a key, and regenerating the API secret) now sends the stored activation token, so a store that migrates to a new domain re-activates on its own rather than failing with a re-bind error.
• Fix: When re-activation is refused because the domain does not match the bound one, the error now explains how to resolve it: set the new domain on the license in the Cognitcxt dashboard, then activate again.

2.3.2

• Naming: Renamed the plugin to “Cognitcxt AI Chat Assistant for WooCommerce” to resolve a WordPress.org Plugin Directory trademark naming violation (display name no longer leads with the WooCommerce trademark).

2.3.1

• Fix: WooCommerce cart session double-serialization bug that caused guest/customer carts to report as empty in MCP tool calls.
• Fix: Product sync cap to enforce a maximum of 100 products per request.

2.3.0

• Security: Domain binding for license activation now uses a signed, server-issued token instead of the client-controlled Origin/Referer headers, preventing license replay from unauthorized domains.
• Security: Chat widget now authenticates using short-lived, domain-bound widget tokens minted per page render instead of embedding the license key in the browser, closing key-scraping from page source.
• Security: /validate now requires the activation token, preventing apiKey exfiltration by key-only callers.
• Fix: WordPress application password is now reused across activations instead of being revoked and recreated each time, so concurrent activations can no longer leave the chat assistant with a revoked credential.
• Security: Anonymous sessions (chat visitors, Call Assist, WhatsApp, CMS) now get a unique per-session guest token instead of a shared hardcoded token that previously resolved every anonymous session to the site admin — guests can no longer impersonate a registered user or the store administrator.

2.2.5

• Fix: Prevent session timeouts and connection drops in ElevenLabs integration by ensuring active socket connections during long WooCommerce database queries.

2.2.4

• Fix: Build customer session data for MCP cart abilities from the persisted session record and live cart keys instead of accessing WC_Session’s protected properties, ensuring correct data is returned for the requested user without relying on internal implementation details.

2.2.3

• Security: Removed user-impersonation (wp_set_current_user) from the WooCommerce cart bootstrap and MCP CLI command to prevent identity-switch side effects and session data leakage.
• Security: Tightened REST ability permission checks so individual ability schemas respect each ability’s own permission callback, not just a baseline ‘read’ capability.

2.2.2

• Fix: Removed str_starts_with() usage that was incompatible with the plugin’s declared minimum WordPress version (5.8).

2.2.1

• Refactor: Renamed the internal CogniTcxt PHP namespace to Cognitcxt for consistent naming.
• Refactor: Renamed internal PHP classes and constants to use the Cognitcxt naming convention consistently.

2.2.0

• Security: Customer-specific MCP abilities (get-cart, update-cart-item, apply-coupon, order-history, manage-account, request-refund) now require a short-lived session_token instead of a caller-supplied user_id, preventing IDOR access to other customers’ data.
• Naming: Renamed all internal mcp_adapter_ filter/action hook names to cognitcxt_mcp_ to avoid potential conflicts with other plugins.

2.1.1

• Update security vulnerability disclosure contact email

2.1.0

• Security: cognitcxt_mcp_permission_check() now requires manage_woocommerce instead of only is_user_logged_in()
• Security: cancel-order, log-feedback, and search-products abilities upgraded to admin-level permission check (manage_woocommerce)
• Security: MCP HTTP transport endpoint now requires manage_woocommerce via mcp_adapter_default_transport_permission_user_capability filter
• Security: internal mcp-adapter abilities (discover-abilities, get-ability-info, execute-ability) now require manage_woocommerce instead of read

2.0.0

• Complete rewrite with license key authentication
• Multi-license support (manage multiple store keys from one WordPress install)
• Bundled MCP Adapter for AI tool-use integration with WooCommerce
• Bundled Abilities API for registering WordPress actions as AI-callable tools
• WooCommerce 9.x compatibility — reuses WooCommerce’s shared MCP adapter when available
• Demo mode for unauthenticated preview links
• HTTPS enforcement for all credential transmissions
• Automatic WordPress Application Password creation and rotation
• Per-page display control

1.0.0

• Initial release