2 Fatal Error

This is PHP 8.4 FPM on pure NGINX on Ubuntu, running multisite

I’m disregarding the second error about the missing class. It has not repeated.

The first error about the missing token has happened again. These payment attempts are from Woo Subscriptions. I’ve had carding attacks and it’s possible I’ve deleted a fake user, or had a fake user create an erroneous token during the subscription signup process.

I am adding a new exception under yours, to see if it even returns a token ID

throw new Exception( __( 'Invalid payment token.', 'woocommerce' ) );
throw new Exception( __( 'Invalid token ID:'.$token->get_id(), 'woocommerce' ) );

If this doesn’t work, I will hook earlier in the subscription renewal process and log the subscription and user ID there. That will give me a timestamp match to find the bad user.

The fatal error seems to take place when my clients are adding new Payment Methods to their accounts. They have not complained that the cards are failing to save, so this may be an error that few people notice. Here is the log and you can see in the stack trace what’s going on:

Uncaught Exception: Invalid payment token. in /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/data-stores/class-wc-payment-token-data-store.php:174

Stack trace:
#0 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/class-wc-data-store.php(159): WC_Payment_Token_Data_Store->read()

#1 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/abstracts/abstract-wc-payment-token.php(79): WC_Data_Store->read()

#2 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/class-wc-payment-tokens.php(172): WC_Payment_Token->__construct()

#3 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/class-wc-payment-tokens.php(50): WC_Payment_Tokens::get()

#4 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/payment-tokens/class-sv-wc-payment-gateway-payment-token.php(632): WC_Payment_Tokens::get_tokens()

#5 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/payment-tokens/class-sv-wc-payment-gateway-payment-token.php(739): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway_Payment_Token->get_woocommerce_payment_token()

#6 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/payment-tokens/class-sv-wc-payment-gateway-payment-tokens-handler.php(853): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway_Payment_Token->save()

#7 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/includes/WC_Braintree_Payment_Method_Handler.php(93): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway_Payment_Tokens_Handler->update_tokens()

#8 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/payment-tokens/class-sv-wc-payment-gateway-payment-tokens-handler.php(741): WC_Braintree\WC_Braintree_Payment_Method_Handler->update_tokens()

#9 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/class-sv-wc-payment-gateway-payment-form.php(160): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway_Payment_Tokens_Handler->get_tokens()

#10 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/includes/Payment_Forms/WC_Braintree_Payment_Form.php(87): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway_Payment_Form->get_tokens()

#11 /usr/share/nginx/mysite/wp-content/plugins/woocommerce-gateway-paypal-powered-by-braintree/vendor/skyverge/wc-plugin-framework/woocommerce/payment-gateway/class-sv-wc-payment-gateway.php(893): WC_Braintree\Payment_Forms\WC_Braintree_Payment_Form->render()

#12 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/templates/myaccount/form-add-payment-method.php(40): SkyVerge\WooCommerce\PluginFramework\v6_0_1\SV_WC_Payment_Gateway->payment_fields()

#13 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/wc-core-functions.php(350): include('...')

#14 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php(416): wc_get_template()

#15 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/wc-template-functions.php(3738): WC_Shortcode_My_Account::add_payment_method()

#16 /usr/share/nginx/mysite/wp-includes/class-wp-hook.php(341): woocommerce_account_add_payment_method()

#17 /usr/share/nginx/mysite/wp-includes/class-wp-hook.php(365): WP_Hook->apply_filters()

#18 /usr/share/nginx/mysite/wp-includes/plugin.php(522): WP_Hook->do_action()

#19 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/wc-template-functions.php(3617): do_action()

#20 /usr/share/nginx/mysite/wp-includes/class-wp-hook.php(341): woocommerce_account_content()

#21 /usr/share/nginx/mysite/wp-includes/class-wp-hook.php(365): WP_Hook->apply_filters()

#22 /usr/share/nginx/mysite/wp-includes/plugin.php(522): WP_Hook->do_action()

#23 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/templates/myaccount/my-account.php(34): do_action()

#24 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/wc-core-functions.php(350): include('...')

#25 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php(121): wc_get_template()

#26 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php(57): WC_Shortcode_My_Account::my_account()

#27 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/class-wc-shortcodes.php(75): WC_Shortcode_My_Account::output()

#28 /usr/share/nginx/mysite/wp-content/plugins/woocommerce/includes/class-wc-shortcodes.php(118): WC_Shortcodes::shortcode_wrapper()

#29 /usr/share/nginx/mysite/wp-includes/shortcodes.php(434): WC_Shortcodes::my_account()

#30 [internal function]: do_shortcode_tag()

#31 /usr/share/nginx/mysite/wp-includes/shortcodes.php(273): preg_replace_callback()

#32 /usr/share/nginx/mysite/wp-includes/class-wp-hook.php(341): do_shortcode()

#33 /usr/share/nginx/mysite/wp-includes/plugin.php(205): WP_Hook->apply_filters()

#34 /usr/share/nginx/mysite/wp-includes/post-template.php(256): apply_filters()

#35 /usr/share/nginx/mysite/wp-content/themes/Divi/page.php(46): the_content()

#36 /usr/share/nginx/mysite/wp-includes/template-loader.php(132): include('...')

#37 /usr/share/nginx/mysite/wp-blog-header.php(19): require_once('...')

#38 /usr/share/nginx/mysite/index.php(17): require('...')

#39 {main}

The only two payment methods available on my system are PP by Braintree and CC by Braintree. I could not reproduce the problem – card addition was successful. And I can’t test Paypal because my Paypal account is the actual account where payments go.

I even stressed the Add Payment Method functionality by adding both a new card and a duplicate card. It correctly reported messages from the Braintree portal and no error was generated in the logs. I guess I’ll just keep an eye on it. Thanks for your time.

Okay, these errors are from carding attacks. I hooked into before_woocommerce_add_payment_method() and logged the user ids.

So now I’m recording each IP address that attempts to add 3 payment methods a day, without regard to the user id, and banning them for 24 hrs via direct addition to the WordFence block table. I’m also recording that IP in a second table so that if they re-offend, it gets banned for 90 days. Here’s what I’m doing:

add_action( 'before_woocommerce_add_payment_method', 'limit_payment_method_additions' );
function limit_payment_method_additions(){
    global $wpdb;
    $additions_table = 'daily_pay_method_additionss';
    $recid_table = 'pay_method_addition_recidivists';
    $ip = $_SERVER['REMOTE_ADDR'];
    $until = 'not yet banned';


    $daily_row = $wpdb->get_results("SELECT * FROM $additions_table WHERE ip = '$ip'");
    $count = $daily_row ? $daily_row->count : false;
    if ( ! $count){
        $wpdb->insert(
                $additions_table,
                array(
                        'ip' => $ip,
                        'count' => 1,
                ),
                array('%s, %d'),
        );
    } else if ($count < 3){
        // You're on thin ice, buddy.
        $count ++;
        $wpdb->update(
                $additions_table,
                array(
                        'ip' => $ip,
                        'count' => $count,
                ),
                array(
                        'ip' => $ip
                )
        );
    } else {
        // HOIST EM
        // if they're a recidivist, we ban them for a month
        $recidivist = $wpdb->get_results("SELECT * FROM $recid_table WHERE ip = '$ip'");
        $until = $recidivist ? time() + 7776000 : time() + 86400;
        $network_ip = inet6_aton($ip);
        $block_reason = $recidivist ? 'Two time payment method offender' :'Exceeded 3 payment method additions in one day';
        $data = array(
                'type' => 1,
                'blockedTime' => time(),
                'expiration' => $until, // 0 means permanent block
                'IP' => $network_ip,
                'lastAttempt' => 0,
                'blockedHits' => 0,
                'reason' => $block_reason,
                'parameters' => serialize(array()),
        );
        $wpdb->insert('wp_wfBlocks7', $data);

        if ( ! $recidivist){ // you will be next time!
            $wpdb->insert(
                    $recid_table,
                    array(
                            'ip' => $ip,
                    ),
                    array('%s'),
            );
        }

        // this table gets truncated each night by cron anyway
        $wpdb->delete($additions_table, array('id' => $daily_row->id), array('%d'));
    }

    $user_id = get_current_user_id();
    $user_blogs = '';
    if ( ! $user_id){
        $user_id = 'User ID False';
    } else {
        $user_blogs = get_blogs_of_user($user_id);
    }

    $caller = 'limit_payment_method_additions()';
    $label = 'Who is this user?';
    $was_recidivist = $recidivist ? 'true':'false';
    $payload = serialize(array(
            '$user_id' => $user_id,
            'ip address' => ip,
            'count' => $count,
            'was a recidivist' => $was_recidivist,
            'ban end time' => $until,
            '$user_blogs' => $user_blogs,
    ));
    custom_log($caller, $label, $payload);
}

Thanks for the corrections! I just whipped that up and didn’t test it. I used sanitize_text_field() on the ip address and changed to $wpdb->get_row(). I will open a ticket soon.