Hello EventON team,

we found a serious bug in EventON Tickets (verified in 2.5.8 and in the current 2.5.12 package, file includes/wc/class-wc-checkout.php, around line 66):

When "Enable auto complete ticket orders" is switched on, the method create_evo_tickets_for_store_api() – hooked to woocommerce_store_api_checkout_order_processed – calls

$order->update_status('completed', 'Order auto-completed for ticket generation (express checkout).');
This hook fires in WooCommerce's Store API checkout (src/StoreApi/Routes/V1/Checkout.php) BEFORE the payment is processed. Immediately afterwards WooCommerce checks $order->needs_payment(). Because the order is already "completed", it returns false and WooCommerce calls process_without_payment() instead of process_payment(). The payment gateway (Stripe in our case) is never called, the customer is never charged, and the order has no transaction ID – but the tickets are generated and e-mailed as paid.

The Store API checkout is used by the WooCommerce Checkout Block and by all express checkout buttons (Apple Pay, Google Pay, Link via the Stripe gateway on product and cart pages). On our site every single express checkout order with Stripe since December 2025 was affected: 32 orders, EUR 2,350 of tickets delivered without any payment. Refunding such orders fails with "An error occurred while attempting to create the refund using the payment gateway API" because there is no charge to refund.

Note that the auto-complete type setting ("Auto complete regardless of payment status", bank transfer, COD, cheque) is ignored in this code path – we only had bank transfer / COD / cheque selected, and online Stripe orders were still auto-completed.

Expected behaviour: For Store API orders the addon must not change the order status before payment. Either

auto-complete only when ! $order->needs_payment() (free orders / offline gateways selected in the auto-complete type setting), or
hook the auto-complete to woocommerce_payment_complete / woocommerce_order_status_processing like the classic checkout path does (class-wc-afterorder.php).
Steps to reproduce:

EventON Tickets → enable "Enable auto complete ticket orders" (type: bank transfer only).
WooCommerce Stripe gateway with express checkout buttons on the product page.
Buy a paid ticket with Apple Pay / Google Pay / Link (or via the Checkout Block).
Order is "Completed" with the note "Order auto-completed for ticket generation (express checkout)", but Stripe shows no payment and the order has no transaction ID.
Our temporary workaround is a mu-plugin that resets such orders to "pending" right after your hook (priority 20) so WooCommerce processes the payment.

Best regards Libelle Wien