Update from 1.1.8 to 1.1.9 breaks WooCommerce checkout in some cases

Hi there,

I have found that there is a 403 error in checkout page when a new customer uses a URL that auto adds to cart and redirects to checkout like this:
https://thedomain.com/checkout/?add-to-cart=1234

The 403 error is on https://thedomain.com/?wc-ajax=update_order_review.

It ONLY happens when the user is not logged in and has not been to the page before. So to test, I had to use incognito/private windows in completely wiped browsers to reproduce (cleared all history/cache/cookies), and just pasted the url with the add to cart string on the end. I was able to reproduce the issue consistently using a URL in this format in fresh browsers.

I initially found that it was breeze plugin by disabling it and seeing no issue.

Then realised, the plugin update from 1.1.8 to 1.1.9 must have caused it since that is when we started noticing it.

It’s been a hard one to track down because it’s intermittent, but I rolled back to the previous version of breeze and the checkout works fine again!

I have scoured the changes between these versions and it isn’t immediately clear what caused this. But it’s certainly something in the 1.1.9 version that does it.

I am happy that I was able to “fix” the issue for now. I have reported via Cloudways support who said they will forward to the correct team, I assume the breeze team who manage this plugin here. I will also post on Cloudways forums.

This is a serious issue because the site owner isn’t immediately aware that there is an issue. It took customers that were willing to fill in the contact form to let us know about it to even notice the issue! How many customers did not do this and just left the site right at payment?

Anyway, this issue basically prevents the payment window from loading, it shows the loading spinner infinitely because of the 403 error that you can see in the console. So after the customer has filled in all their details, they simply can’t pay, and don’t notice until they get to that part of the page.

I hope this at least helps someone else fix their issue quickly by simply rolling back to 1.1.8. It would have saved us hours of troubleshooting doing all the standard WP troubleshooting steps which came up empty (the deactivating of everything and reactivating one by one)… after which we ended up finding it was breeze and trying ALL of the options to exclude files and URLs. Simply could not stop the issue. It was only when we realised it had been happening since a certain timeframe that we noticed breeze was also updated at this time.

Outside this, amazing plugin when you use Cloudways hosting. Varnish and CDN built in is super simple setup as well. Love it. Just need this issue fixed so we can update to the latest version again.