FAIR

Federated and Independent Repositories

MIA, Bank Card & StarCard Payment Gateway for VictoriaBank (Community Edition)

Plugin Banner

MIA, Bank Card & StarCard Payment Gateway for VictoriaBank (Community Edition)

by inginerit

Download
Description

MIA, Bank Card & StarCard Payment Gateway for VictoriaBank (Community Edition) is a comprehensive WooCommerce plugin that enables Moldovan merchants to accept all VictoriaBank payment methods through a single plugin.

This is a community-developed plugin and is not officially affiliated with or endorsed by VictoriaBank.

Supported Payment Methods

  • MIA Instant Payment – QR-code based instant payments via Moldova’s MIA system
  • Visa / Mastercard – International card payments via VictoriaBank e-Gateway with RSA SHA-256 digital signatures
  • StarCard Installments – Pay in installments (3, 6, 12, or 24 months) with VictoriaBank StarCard
  • StarCard Loyalty Points – Pay with accumulated StarCard loyalty points

Key Features

  • 4 payment methods in a single plugin – one installation, complete coverage
  • RSA SHA-256 digital signatures (P_SIGN) for secure e-Gateway communication
  • Two-phase transaction flow (TRTYPE=0 authorization + TRTYPE=21 completion) for card payments
  • Dynamic QR codes with configurable TTL for MIA payments
  • Mobile deeplink support (mia://pay) for seamless mobile MIA payments
  • Automatic status polling (TRTYPE=90) every 3 minutes as callback fallback
  • Full and partial refunds – TRTYPE=24 for card payments; full or partial refund for MIA (MIA API 2.1)
  • WooCommerce Cart & Checkout Blocks – all four methods work in both the block-based and the classic checkout
  • JWT webhook verification (RS256) for MIA payment notifications
  • Token caching for MIA API calls (reduces API calls by 98%)
  • HPOS compatible – Full support for WooCommerce High-Performance Order Storage
  • WooCommerce Action Scheduler support for reliable background polling
  • WC_Logger integration – card payment logs at WooCommerce > Status > Logs

Payment Flows

Card Payments (Visa/MC, StarCard):

  1. Customer selects payment method at checkout
  2. Plugin generates TRTYPE=0 parameters with P_SIGN digital signature
  3. Customer is redirected to VictoriaBank secure payment page
  4. Bank sends callback with authorization result
  5. Plugin automatically executes TRTYPE=21 (Sales Completion)
  6. Order is marked as paid

MIA Instant Payment:

  1. Customer selects MIA at checkout
  2. Dynamic QR code is generated via VictoriaBank API
  3. Customer scans QR code or uses mobile deeplink
  4. Payment is confirmed via JWT webhook or AJAX polling
  5. Order status updates automatically

Requirements

  • WordPress 6.0 or higher
  • WooCommerce 7.0 or higher
  • PHP 8.0 or higher (required for RSA cryptographic operations)
  • PHP OpenSSL extension
  • Active VictoriaBank merchant account with API credentials
  • HTTPS enabled on your website

Configuration

After installation, configure each payment method at WooCommerce > Settings > Payments:

For MIA Instant Payment:
* API credentials (username, password)
* Merchant IBAN
* VictoriaBank public key (VBCA.crt) for JWT verification
* QR code expiry time

For Visa/Mastercard, StarCard methods:
* Terminal ID (8 digits) and Merchant ID (15 digits) from VictoriaBank
* Your own RSA key pair, generated by you before configuration (see FAQ below) — paste your private key and VictoriaBank’s public key (.pem) for callback verification
* Register callback URL with VictoriaBank: https://yoursite.com/?wc-api=vb_callback

Technical Details

MIA API Endpoints

  • Authentication: POST /identity/token
  • QR Creation: POST /api/v1/qr
  • Full refund: DELETE /api/v1/transaction/{id}
  • Partial refund: DELETE /api/v1/transaction/{id}/partial-refund (body: {"amount": <number>})

Base URLs

  • Test Environment: https://test-ipspj.victoriabank.md
  • Production: https://ips-api-pj.vb.md

Security

  • JWT token authentication
  • Token caching with automatic expiry
  • HTTPS required (enforced by API)
  • Nonce verification for AJAX requests
  • Input sanitization and validation
  • No sensitive data logged (passwords masked)

Compatibility

  • WordPress 6.0+
  • WooCommerce 7.0 – 11.1
  • PHP 8.0+
  • Tested with latest WordPress and WooCommerce versions

Third-Party Services

This plugin connects to VictoriaBank’s payment APIs:

  • e-Gateway (card payments): https://ecomt.victoriabank.md (test) / https://vb059.vb.md (production)
  • MIA IPS API (instant payments): https://test-ipspj.victoriabank.md (test) / https://ips-api-pj.vb.md (production)

By using this plugin, you agree to VictoriaBank’s terms of service and privacy policy: https://victoriabank.md

Privacy Policy

This plugin does not collect, store, or transmit any personal data outside of what is necessary for payment processing through VictoriaBank’s APIs. All payment data is transmitted securely via HTTPS.

Credits

Developed and maintained by an independent developer for the WooCommerce and Moldovan e-commerce community.

Source code: https://github.com/inginerit/MIA-Payment-Gateway-for-VictoriaBank

Automatic Installation

  1. Go to Plugins > Add New in your WordPress admin
  2. Search for “MIA Payment Gateway for VictoriaBank”
  3. Click Install Now and then Activate

Manual Installation

  1. Download the plugin ZIP file
  2. Go to Plugins > Add New > Upload Plugin
  3. Choose the ZIP file and click Install Now
  4. Click Activate Plugin

Upgrading from MIA-only version (2.x)

If you are upgrading from the MIA-only version (2.x), the MIA payment method will continue to work exactly as before (including partial refunds added in 2.2.0). The new card payment methods (Visa/Mastercard, StarCard) are added as separate gateways and can be enabled independently.

No database migration is needed. Your existing MIA settings and transaction history are preserved.

Is this an official VictoriaBank plugin?

No, this is a community-developed plugin. It integrates with VictoriaBank’s official APIs but is not officially affiliated with or endorsed by VictoriaBank.

Do I need separate terminal IDs for each card payment method?

Yes. VictoriaBank assigns separate Terminal IDs for Visa/Mastercard, StarCard Installments, and StarCard Points. Each method has its own settings page.

Can I enable only some payment methods?

Yes. Each payment method (MIA, Visa/MC, StarCard Rate, StarCard Points) can be enabled or disabled independently.

What is the callback URL I need to register with VictoriaBank?

For card payments: https://yoursite.com/?wc-api=vb_callback
For MIA webhooks: https://yoursite.com/wp-json/miapg/v1/webhook

How do I generate my RSA key pair for card payments (Visa/Mastercard, StarCard)?

The RSA key pair used to sign requests sent to VictoriaBank (P_SIGN) is generated by you, the merchant — the plugin never generates it, and VictoriaBank does not send you a private key. Steps:

  1. Generate the key pair on your own computer (not on the live server), using OpenSSL:
    openssl genrsa -out merchant_private.pem 2048
    openssl rsa -in merchant_private.pem -pubout -out merchant_public.pem
  2. Keep merchant_private.pem secret. Never email it, never upload it anywhere public, never share it with VictoriaBank support — your private key only has to exist on your own machine and inside this plugin’s settings.
  3. Send merchant_public.pem (the public key only) to VictoriaBank when you request or activate your e-Gateway terminal (Visa/Mastercard, StarCard Installments, StarCard Points each need their own terminal, see above).
  4. In return, VictoriaBank gives you: your Terminal ID and Merchant ID for that payment method, plus VictoriaBank’s own public key (a separate .pem file, used to verify the bank’s callbacks — this one is provided by the bank).
  5. In WooCommerce > Settings > Payments, open the gateway for that payment method and paste:
    • your merchant_private.pem content into “RSA private key (.pem)”
    • VictoriaBank’s public key content into “VictoriaBank public key (.pem)”
  6. Repeat steps 1-5 separately for each card payment method you enable (Visa/Mastercard, StarCard Installments, StarCard Points use separate terminals and can use separate key pairs, or the same one if VictoriaBank allows it for your contract — confirm with your VictoriaBank account manager).

The plugin validates the private key format on save and will show an error if the pasted PEM is invalid.

How do refunds work?

For card payments, use the standard WooCommerce refund button. The plugin sends TRTYPE=24 to VictoriaBank automatically.
For MIA payments, both full and partial refunds are supported from the same WooCommerce refund button. Important: MIA allows only ONE refund per payment (either the full amount or a single partial amount) – after a partial refund, the remaining amount cannot be refunded through MIA. A MIA payment can be refunded a few minutes after it was made, once the bank has settled it.

Does the plugin work with the WooCommerce Checkout block?

Yes. All payment methods are available both in the block-based Cart & Checkout (default in new WooCommerce stores) and in the classic shortcode checkout.

Is HPOS (High-Performance Order Storage) supported?

Yes, the plugin is fully compatible with WooCommerce HPOS.

How do I enable debug logging?

Add the following to your wp-config.php file:
define(‘WP_DEBUG’, true);
define(‘WP_DEBUG_LOG’, true);
define(‘WP_DEBUG_DISPLAY’, false);
Then enable “Debug Logging” in the MIA gateway settings. Card payment logs are available at WooCommerce > Status > Logs (source: mia-payment-gateway-for-victoriabank).

3.0.3

  • Fixed: The “RSA private key (.pem)” field description (Visa/Mastercard, StarCard settings) incorrectly stated the key was “provided by VictoriaBank”. It is generated by the merchant, not the bank – the description now says so clearly.
  • Added: New FAQ “How do I generate my RSA key pair for card payments?” with step-by-step OpenSSL instructions (what to generate, what stays secret, what to send to VictoriaBank, what you get back, where to paste it).

3.0.2

  • Security: raised minimum required PHP version to 8.2, following the critical unauthenticated RCE vulnerabilities disclosed on 2026-10-20/22 and patched by the PHP project on 2026-10-21 (CVE-2026-109618, CVE-2026-109619). PHP 8.0 and 8.1 are end-of-life and will not receive this fix. If your host still runs 8.0/8.1, please ask them to upgrade PHP before updating this plugin.
  • Recommended: confirm with your hosting provider that the latest PHP point release for your branch is applied (8.2.35+, 8.3.36+, 8.4.27+ or 8.5.12+).

3.0.1

  • Added: The MIA callback (signals) URL to send to VictoriaBank is now shown in the MIA settings page (the card callback URL is shown in each card gateway settings page).
  • Fixed: The MIA signals endpoint (/wp-json/miapg/v1/webhook) was not registered on REST requests (gateways are loaded lazily by WooCommerce), so bank notifications were answered with 404 and payments were confirmed only by polling.
  • Security: MIA signals are accepted only with a valid RS256 signature. The current VictoriaBank signal certificates are bundled; additional certificates can be pasted in the settings (certificate rotation).

3.0.0

  • Major update: added Visa/Mastercard, StarCard Installments and StarCard Points (VictoriaBank e-Gateway) next to MIA – one plugin for all VictoriaBank payment methods
  • Added: RSA SHA-256 digital signature (P_SIGN) generation and verification, with MD5 fallback for legacy terminals
  • Added: Two-phase card flow – TRTYPE=0 authorization, TRTYPE=21 sales completion, confirmation by bank push
  • Added: TRTYPE=24 refunds for card payments
  • Added: TRTYPE=90 status polling every 3 minutes (Action Scheduler / WP-Cron) as callback fallback, including TRTYPE=21 retry
  • Added: WooCommerce Cart & Checkout Blocks support for all four payment methods
  • Added: Admin test mode notices with one-click switch between test and production
  • Added: PEM key validation on settings save
  • Requires PHP 8.0+ and WooCommerce 7.0+
  • Tested with WordPress 7.1 and WooCommerce 11.1

2.2.0

  • Added: MIA partial refunds (MIA API 2.1)
  • Added: WooCommerce Cart & Checkout Blocks support for MIA
  • Fixed: Payment reference not saved when payment was confirmed by polling; refunds recover a missing reference from the API
  • Fixed: Text domain now matches the plugin slug

2.1.4

  • Fixed: Polling expiry – use absolute time instead of attempt counter

2.1.3

  • Fixed: Authentication endpoint updated to /api/identity/token
  • Enhanced: Comprehensive logging throughout the plugin
  • Improved: Error handling for API communications
  • Optimized: Token caching reduces API calls by 98%
  • Added: Mobile deeplink support for direct app payments
  • Added: AJAX payment status checking with automatic updates
  • Added: Full refund support via VictoriaBank API
  • Added: HPOS (High-Performance Order Storage) compatibility

2.1.2

  • Fixed authentication issues
  • Improved QR code generation reliability

2.1.0

  • Initial release with MIA payment support
Back to top