EPS - Easy Payment System for WooCommerce

Accept Visa, Mastercard, and Mobile Financial Services payments in WooCommerce using EPS, the Easy Payment System gateway for Bangladesh.

Features

• WooCommerce payment gateway for EPS.
• Visa, Mastercard, and MFS payment support.
• Sandbox and production mode switching.
• HMAC-SHA512 request signing for EPS API requests.
• Transaction dashboard inside WordPress admin.
• Gateway transaction sync for 7 days or 12 months.
• Product delivery/status tracking for transactions.
• WooCommerce Blocks checkout integration.
• USD store currency support with configurable USD to BDT conversion for EPS.

Requirements

Installation

WordPress Dashboard

1. Download the release ZIP from GitHub.
2. Go to WordPress Dashboard > Plugins > Add New.
3. Click Upload Plugin.
4. Choose the ZIP file and click Install Now.
5. Activate the plugin.
6. Open EPS Payment > Settings.
7. Enter the EPS merchant credentials.
8. Go to WooCommerce > Settings > Payments and enable EPS.

Setup video: https://youtu.be/SY6LFRjH6ZM

Manual Install

1. Extract the ZIP file.
2. Upload the plugin folder to /wp-content/plugins/.
3. Activate EPS from WordPress Dashboard > Plugins.

Configuration

Required EPS settings:

• Username
• Password / Plugin key
• Hash key
• Merchant ID
• Store ID
• Mode: sandbox or production
• USD to BDT rate, required when WooCommerce orders are in USD

Currency Handling

EPS accepts BDT payments. If a WooCommerce order is already in BDT, the plugin sends the order total unchanged. If an order is in USD, the plugin converts the total to BDT using the configured USD to BDT rate before sending the payment request to EPS.

For converted USD orders, the plugin stores these order meta values:

• _eps_original_amount
• _eps_original_currency
• _eps_bdt_amount
• _eps_exchange_rate

If WooCommerce uses USD and no USD to BDT rate is configured, EPS checkout is blocked with an error instead of sending the wrong amount.

Security

This release includes the payment-security hardening requested for WordPress review:

• Orders are marked paid only after EPS confirms Success.
• Merchant transaction IDs are stored in order meta and verified on return.
• SQL queries use $wpdb->prepare() placeholders where user-controlled values are involved.
• Settings are stored as JSON with backward-compatible legacy migration.
• Outbound EPS HTTP requests use SSL verification.
• Transaction AJAX endpoints require admin capability and nonce checks.
• Unauthenticated transaction AJAX access has been removed.
• Debug script injection has been removed.
• Invoice IDs use cryptographically secure random bytes.
• POST settings fields are sanitized and mode is whitelisted.
• Deprecated utf8_encode() usage has been replaced.
• Global PHP warning suppression has been removed.

Repository

• Plugin page: https://github.com/RayhanSysMin/EPS_Woocommerce
• Author: RayhanSysMin - https://github.com/RayhanSysMin
• EPS website: https://eps.com.bd

License

GPL-2.0-or-later. See https://www.gnu.org/licenses/gpl-2.0.html.