Changeset 3740977

Timestamp:

10/12/2026 09:34:26 AM (6 days ago)

Author:

Dhruvin

Message:

1.7.7 release

Location:

woo-addon-uploads

Files:

• tags/1.7.7 (added)
• tags/1.7.7/assets (added)
• tags/1.7.7/assets/css (added)
• tags/1.7.7/assets/css/wau_features.css (added)
• tags/1.7.7/assets/css/wau_styles.css (added)
• tags/1.7.7/i18n (added)
• tags/1.7.7/i18n/languages (added)
• tags/1.7.7/i18n/languages/woo-addon-uploads.pot (added)
• tags/1.7.7/includes (added)
• tags/1.7.7/includes/class-wau-admin-settings.php (added)
• tags/1.7.7/includes/class-wau-admin.php (added)
• tags/1.7.7/includes/class-wau-front-end.php (added)
• tags/1.7.7/includes/class-wau-pro-features.php (added)
• tags/1.7.7/readme.txt (added)
• tags/1.7.7/uninstall.php (added)
• tags/1.7.7/woocommerce-addon-uploads.php (added)
• trunk/i18n/languages/woo-addon-uploads.pot (modified) (8 diffs)
• trunk/includes/class-wau-admin.php (modified) (12 diffs)
• trunk/includes/class-wau-front-end.php (modified) (23 diffs)
• trunk/readme.txt (modified) (6 diffs)
• trunk/woocommerce-addon-uploads.php (modified) (2 diffs)

woo-addon-uploads/trunk/i18n/languages/woo-addon-uploads.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: File Uploads Addon for WooCommerce 1.7.6\n"
+"Project-Id-Version: File Uploads Addon for WooCommerce 1.7.7\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/woo-addon-uploads\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
@@ -88 +88 @@
 
 #: includes/class-wau-admin.php:135
-msgid "Private upload storage is unavailable, so new customer uploads are paused."
+msgid "Private and encrypted storage are unavailable, so new customer uploads are paused."
 msgstr ""
 
@@ -212 +212 @@
 msgstr ""
 
-#: includes/class-wau-admin.php:226
-msgid "No immediate action is required. New uploads are using private storage and legacy files are either migrated or not present."
+#: includes/class-wau-admin.php:228
+msgid "No immediate security action is required. New uploads are using private storage or authenticated encrypted storage, and no public plaintext customer files remain."
 msgstr ""
 
@@ -237 +237 @@
 
 #. translators: %s: PHP constant example.
-#: includes/class-wau-admin.php:331
-msgid "New customer uploads are paused because private storage is unavailable. Ask your host for a writable private directory outside the public web root, then add %s to wp-config.php with that absolute path."
+#: includes/class-wau-admin.php:350
+msgid "New customer uploads are paused because neither private nor encrypted storage is available. Ask your host for a writable private directory outside the public web root, then add %s to wp-config.php with that absolute path."
 msgstr ""
 
@@ -259 +259 @@
 msgstr ""
 
-#: includes/class-wau-admin.php:361
-msgid "Legacy files are still being migrated to private storage in small batches. Keep the plugin active and allow normal site traffic or admin page visits to continue the migration."
+#: includes/class-wau-admin.php:380
+msgid "Public plaintext files are still being migrated in small batches. Keep the plugin active and allow normal site traffic or admin page visits to continue the migration."
 msgstr ""
 
@@ -283 +283 @@
 msgstr ""
 
-#: includes/class-wau-admin.php:451
-msgid "Waiting for private storage"
+#: includes/class-wau-admin.php:520
+msgid "Blocked: no secure storage backend is available"
 msgstr ""
 
@@ -331 +331 @@
 msgstr ""
 
-#: includes/class-wau-front-end.php:891
-msgid "File upload is temporarily unavailable because private upload storage could not be created. Please contact the store administrator."
+#: includes/class-wau-front-end.php:1433
+msgid "File upload is temporarily unavailable because secure upload storage could not be created. Please contact the store administrator."
 msgstr ""
 
@@ -373 +373 @@
 msgid "File does not exist."
 msgstr ""
+
+#: includes/class-wau-admin.php:190
+msgid "Encrypted fallback storage"
+msgstr ""
+
+#: includes/class-wau-admin.php:191
+msgid "Encrypted container count"
+msgstr ""
+
+#: includes/class-wau-admin.php:196
+msgid "Public plaintext file count"
+msgstr ""
+
+#: includes/class-wau-admin.php:290
+msgid "Available with authenticated encryption"
+msgstr ""
+
+#: includes/class-wau-admin.php:290
+msgid "Unavailable: encryption key is missing"
+msgstr ""
+
+#: includes/class-wau-admin.php:344
+msgid "Encrypted upload containers exist, but their encryption key is missing from the WordPress database. Restore the wau_encryption_key option from a matching database backup. Do not delete the encrypted files or generate a replacement key."
+msgstr ""
+
+#: includes/class-wau-front-end.php:1457
+msgid "File upload failed while creating secure encrypted storage. Please try again."
+msgstr ""
+
+#: includes/class-wau-front-end.php:2163
+msgid "The encrypted file could not be authenticated."
+msgstr ""

woo-addon-uploads/trunk/includes/class-wau-admin.php

@@ -132 +132 @@
                                                         <?php esc_html_e( 'Legacy customer files are still present in the public uploads folder. Confirm that direct requests to the path below return 403 or 404 until migration is complete.', 'woo-addon-uploads' ); ?>
                                                 </p>
-                                                <?php if ( ! $status['private_storage_ok'] ) : ?>
-                                                        <p><?php esc_html_e( 'Private upload storage is unavailable, so new customer uploads are paused.', 'woo-addon-uploads' ); ?></p>
+                                                <?php if ( ! $status['private_storage_ok'] && ! $status['encrypted_storage_ok'] ) : ?>
+                                                        <p><?php esc_html_e( 'Private and encrypted storage are unavailable, so new customer uploads are paused.', 'woo-addon-uploads' ); ?></p>
                                                 <?php endif; ?>
                                                 <?php if ( $status['uses_nginx_location_rules'] ) : ?>
@@ -188 +188 @@
                                                         <?php $this->render_status_row( __( 'Private upload storage', 'woo-addon-uploads' ), $status['private_storage_label'], $status['private_storage_ok'] ? 'success' : 'warning' ); ?>
                                                         <?php $this->render_status_row( __( 'Private upload path', 'woo-addon-uploads' ), $status['private_path'] ? $status['private_path'] : __( 'Not available', 'woo-addon-uploads' ), $status['private_storage_ok'] ? 'info' : 'warning' ); ?>
+                                                        <?php $this->render_status_row( __( 'Encrypted fallback storage', 'woo-addon-uploads' ), $status['encrypted_storage_label'], $status['encrypted_storage_ok'] ? 'success' : 'warning' ); ?>
+                                                        <?php $this->render_status_row( __( 'Encrypted container count', 'woo-addon-uploads' ), (string) $status['encrypted_file_count'], 'info' ); ?>
                                                         <?php $this->render_status_row( __( 'Manual override', 'woo-addon-uploads' ), "define( 'WAU_PRIVATE_UPLOAD_DIR', '/absolute/private/path/' );", 'info' ); ?>
                                                         <?php $this->render_status_row( __( 'Legacy upload path', 'woo-addon-uploads' ), $status['legacy_path'], 'info' ); ?>
                                                         <?php $this->render_status_row( __( 'Legacy upload URL path', 'woo-addon-uploads' ), $status['legacy_url_path'], 'info' ); ?>
                                                         <?php $this->render_status_row( __( 'Legacy folder exists', 'woo-addon-uploads' ), $status['legacy_exists'] ? __( 'Yes', 'woo-addon-uploads' ) : __( 'No', 'woo-addon-uploads' ), $status['legacy_exists'] ? 'info' : 'success' ); ?>
-                                                        <?php $this->render_status_row( __( 'Legacy file count', 'woo-addon-uploads' ), (string) $status['legacy_file_count'], $status['legacy_file_count'] > 0 ? 'warning' : 'success' ); ?>
+                                                        <?php $this->render_status_row( __( 'Public plaintext file count', 'woo-addon-uploads' ), (string) $status['legacy_file_count'], $status['legacy_file_count'] > 0 ? 'warning' : 'success' ); ?>
                                                 </tbody>
                                         </table>
@@ -224 +226 @@
                                                         </ul>
                                                 <?php else : ?>
-                                                        <p><?php esc_html_e( 'No immediate action is required. New uploads are using private storage and legacy files are either migrated or not present.', 'woo-addon-uploads' ); ?></p>
+                                                        <p><?php esc_html_e( 'No immediate security action is required. New uploads are using private storage or authenticated encrypted storage, and no public plaintext customer files remain.', 'woo-addon-uploads' ); ?></p>
                                                 <?php endif; ?>
                                         </div>
@@ -254 +256 @@
                         $legacy_url_path  = trailingslashit( $baseurl_path ? $baseurl_path : '/wp-content/uploads' ) . 'wau-uploads/';
                         $legacy_exists    = $legacy_path && is_dir( $legacy_path );
+                        $encrypted_path   = $legacy_path ? trailingslashit( $legacy_path ) . 'encrypted/' . $this->get_site_storage_key() . '/' : '';
                         $private_status   = get_option( 'wau_private_uploads_available' );
                         $private_path     = get_option( 'wau_private_uploads_path' );
@@ -265 +268 @@
                         $server_unknown     = ( empty( $server_lower ) || ( ! $uses_nginx_rules && ! $uses_openlitespeed && ! $uses_caddy && ! $uses_apache ) );
                         $legacy_count     = $legacy_exists ? $this->count_legacy_upload_files( $legacy_path ) : 0;
+                        $encrypted_count  = $encrypted_path && is_dir( $encrypted_path ) ? $this->count_encrypted_upload_files( $encrypted_path ) : 0;
+                        $encryption_ok    = $this->encrypted_fallback_is_available( $legacy_path, $encrypted_path, $upload_dir );
+                        $encoded_key      = get_option( 'wau_encryption_key', '' );
+                        $encryption_key   = is_string( $encoded_key ) ? base64_decode( $encoded_key, true ) : false;
+                        $key_missing      = $encrypted_count > 0 && ( ! is_string( $encryption_key ) || 32 !== strlen( $encryption_key ) );
+                        if ( $key_missing ) {
+                                $encryption_ok = false;
+                        }
                         $htaccess_status  = $this->get_protection_file_status( $legacy_path . '.htaccess', $this->get_expected_htaccess_content(), $legacy_exists );
                         $web_conf_status  = $this->get_protection_file_status( $legacy_path . 'web.config', $this->get_expected_web_config_content(), $legacy_exists );
@@ -276 +287 @@
                                 'private_storage_label'    => $private_ok ? __( 'Available and writable', 'woo-addon-uploads' ) : __( 'Not available or not writable', 'woo-addon-uploads' ),
                                 'private_path'             => $private_path,
+                                'encrypted_storage_ok'     => $encryption_ok,
+                                'encrypted_storage_label'  => $encryption_ok ? __( 'Available with authenticated encryption', 'woo-addon-uploads' ) : ( $key_missing ? __( 'Unavailable: encryption key is missing', 'woo-addon-uploads' ) : __( 'Unavailable', 'woo-addon-uploads' ) ),
+                                'encrypted_file_count'     => $encrypted_count,
+                                'encryption_key_missing'   => $key_missing,
                                 'legacy_path'              => $legacy_path ? $legacy_path : __( 'Unavailable', 'woo-addon-uploads' ),
                                 'legacy_url_path'          => $legacy_url_path,
@@ -288 +303 @@
                                 'legacy_verification_needed' => $verify_needed,
                                 'uses_nginx_location_rules' => $uses_nginx_rules,
-                                'migration_complete'       => ( 0 === $legacy_count && $private_ok ),
-                                'migration_label'          => $this->get_migration_label( $private_ok, $legacy_count ),
+                                'migration_complete'       => ( 0 === $legacy_count ),
+                                'migration_label'          => $this->get_migration_label( $private_ok, $encryption_ok, $legacy_count ),
                                 'migration_batch_size'     => $batch_size,
-                                'has_required_action'      => ( ! $private_ok || $server_needed || $verify_needed || ( $legacy_exists && ( ! $htaccess_status['ok'] || ! $web_conf_status['ok'] ) ) || ( $private_ok && $legacy_count > 0 ) ),
+                                'has_required_action'      => ( ( ! $private_ok && ! $encryption_ok ) || $server_needed || $verify_needed || ( $legacy_exists && ( ! $htaccess_status['ok'] || ! $web_conf_status['ok'] ) ) || $legacy_count > 0 ),
                         );
                 }
@@ -326 +341 @@
                         $items = array();
 
-                        if ( ! $status['private_storage_ok'] ) {
+                        if ( $status['encryption_key_missing'] ) {
+                                $items[] = __( 'Encrypted upload containers exist, but their encryption key is missing from the WordPress database. Restore the wau_encryption_key option from a matching database backup. Do not delete the encrypted files or generate a replacement key.', 'woo-addon-uploads' );
+                        }
+
+                        if ( ! $status['private_storage_ok'] && ! $status['encrypted_storage_ok'] ) {
                                 $items[] = sprintf(
                                         /* translators: %s: PHP constant example. */
-                                        __( 'New customer uploads are paused because private storage is unavailable. Ask your host for a writable private directory outside the public web root, then add %s to wp-config.php with that absolute path.', 'woo-addon-uploads' ),
+                                        __( 'New customer uploads are paused because neither private nor encrypted storage is available. Ask your host for a writable private directory outside the public web root, then add %s to wp-config.php with that absolute path.', 'woo-addon-uploads' ),
                                         '<code>define( \'WAU_PRIVATE_UPLOAD_DIR\', \'/absolute/private/path/\' );</code>'
                                 );
@@ -358 +377 @@
                         }
 
-                        if ( $status['private_storage_ok'] && $status['legacy_file_count'] > 0 && ! $status['migration_complete'] ) {
-                                $items[] = __( 'Legacy files are still being migrated to private storage in small batches. Keep the plugin active and allow normal site traffic or admin page visits to continue the migration.', 'woo-addon-uploads' );
+                        if ( ( $status['private_storage_ok'] || $status['encrypted_storage_ok'] ) && $status['legacy_file_count'] > 0 && ! $status['migration_complete'] ) {
+                                $items[] = __( 'Public plaintext files are still being migrated in small batches. Keep the plugin active and allow normal site traffic or admin page visits to continue the migration.', 'woo-addon-uploads' );
                         }
 
@@ -385 +404 @@
                                 }
 
-                                if ( in_array( strtolower( $file_info->getFilename() ), array( '.htaccess', 'web.config', 'index.php' ), true ) ) {
+                                if ( in_array( strtolower( $file_info->getFilename() ), array( '.htaccess', 'web.config', 'index.php' ), true ) || '.wau-pending' === substr( $file_info->getFilename(), -12 ) ) {
                                         continue;
                                 }
@@ -393 +412 @@
 
                         return $count;
+                }
+
+                /**
+                 * Count authenticated encrypted containers.
+                 *
+                 * @param string $encrypted_path Encrypted fallback path.
+                 * @return int
+                 */
+                private function count_encrypted_upload_files( $encrypted_path ) {
+                        $count = 0;
+
+                        try {
+                                $directory = new DirectoryIterator( $encrypted_path );
+                        } catch ( Exception $exception ) {
+                                return 0;
+                        }
+
+                        foreach ( $directory as $file_info ) {
+                                if ( ! $file_info->isDot() && $file_info->isFile() && '.wau' === strtolower( substr( $file_info->getFilename(), -4 ) ) ) {
+                                        $count++;
+                                }
+                        }
+
+                        return $count;
+                }
+
+                /**
+                 * Check whether the host can use authenticated encrypted fallback storage.
+                 *
+                 * @param string $legacy_path    Legacy storage path.
+                 * @param string $encrypted_path Encrypted fallback path.
+                 * @param array  $upload_dir     WordPress upload directory data.
+                 * @return bool
+                 */
+                private function encrypted_fallback_is_available( $legacy_path, $encrypted_path, $upload_dir ) {
+                        $sodium_available = function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_push' )
+                                && function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_pull' );
+                        $openssl_available = function_exists( 'openssl_encrypt' )
+                                && function_exists( 'openssl_decrypt' )
+                                && in_array( 'aes-256-gcm', openssl_get_cipher_methods(), true );
+
+                        if ( ! $sodium_available && ! $openssl_available ) {
+                                return false;
+                        }
+
+                        if ( $encrypted_path && is_dir( $encrypted_path ) ) {
+                                return wp_is_writable( $encrypted_path );
+                        }
+
+                        if ( $legacy_path && is_dir( $legacy_path ) ) {
+                                return wp_is_writable( $legacy_path );
+                        }
+
+                        return empty( $upload_dir['error'] ) && is_dir( $upload_dir['basedir'] ) && wp_is_writable( $upload_dir['basedir'] );
+                }
+
+                /**
+                 * Build the same site-specific storage key used by the upload handler.
+                 *
+                 * @return string
+                 */
+                private function get_site_storage_key() {
+                        $home_url = home_url( '/' );
+                        $host     = wp_parse_url( $home_url, PHP_URL_HOST );
+                        $host     = $host ? strtolower( $host ) : 'site';
+                        $host     = preg_replace( '/[^a-z0-9._-]/', '-', $host );
+                        $host     = str_replace( '.', '-', $host );
+                        $blog_id  = function_exists( 'get_current_blog_id' ) ? get_current_blog_id() : 1;
+                        $hash     = substr( hash( 'sha256', $home_url . '|' . ABSPATH . '|' . $blog_id ), 0, 12 );
+
+                        return sanitize_file_name( $host . '-' . $blog_id . '-' . $hash );
                 }
 
@@ -443 +533 @@
                  * Get migration label.
                  *
-                 * @param bool $private_ok   Whether private storage is available.
-                 * @param int  $legacy_count Legacy file count.
+                 * @param bool $private_ok    Whether private storage is available.
+                 * @param bool $encryption_ok Whether encrypted fallback is available.
+                 * @param int  $legacy_count  Legacy file count.
                  * @return string
                  */
-                private function get_migration_label( $private_ok, $legacy_count ) {
-                        if ( ! $private_ok ) {
-                                return __( 'Waiting for private storage', 'woo-addon-uploads' );
+                private function get_migration_label( $private_ok, $encryption_ok, $legacy_count ) {
+                        if ( ! $private_ok && ! $encryption_ok ) {
+                                return __( 'Blocked: no secure storage backend is available', 'woo-addon-uploads' );
                         }
 

woo-addon-uploads/trunk/includes/class-wau-front-end.php

@@ -25 +25 @@
         class wau_front_end_class {
 
+                const WAU_ENCRYPTED_FILE_MAGIC = 'WAUENC01';
+                const WAU_ENCRYPTED_CHUNK_SIZE = 1048576;
+
                 /**
                  * Resolved private upload directory for the current request.
@@ -48 +51 @@
 
                         add_filter( 'wau_category_checks', array( $this, 'wau_check_category_allowed' ), 10, 2 );
-
                         add_action( 'woocommerce_cart_item_removed', array( $this, 'wau_remove_cart_action' ), 10, 2 );
 
@@ -166 +168 @@
 
                 /**
-                 * Move legacy public uploads into private storage in small batches.
+                 * Move legacy public uploads into private storage or encrypt them in place.
                  *
                  * @since 1.7.5
@@ -176 +178 @@
                         $legacy_upload_dir  = $this->wau_get_legacy_upload_directory();
 
-                        if ( empty( $private_upload_dir['path'] ) || empty( $legacy_upload_dir['path'] ) ) {
+                        if ( empty( $legacy_upload_dir['path'] ) || ! is_dir( $legacy_upload_dir['path'] ) ) {
                                 return;
                         }
 
-                        $private_path = $private_upload_dir['path'];
+                        if ( get_transient( 'wau_legacy_upload_migration_lock' ) ) {
+                                return;
+                        }
+
+                        set_transient( 'wau_legacy_upload_migration_lock', 1, 5 * MINUTE_IN_SECONDS );
+
+                        $private_path = ! empty( $private_upload_dir['path'] ) ? $private_upload_dir['path'] : '';
                         $legacy_path  = $legacy_upload_dir['path'];
 
-                        if ( $this->wau_paths_match( $private_path, $legacy_path ) || ! is_dir( $legacy_path ) ) {
+                        if ( $private_path && $this->wau_paths_match( $private_path, $legacy_path ) ) {
                                 update_option( 'wau_legacy_upload_migration_complete', current_time( 'mysql' ), false );
+                                delete_transient( 'wau_legacy_upload_migration_lock' );
                                 return;
                         }
@@ -195 +204 @@
                         WP_Filesystem();
 
-                        if ( ! $wp_filesystem || ! $this->wau_prepare_upload_directory( $private_path ) ) {
+                        $encrypted_path = '';
+                        if ( empty( $private_path ) ) {
+                                $encrypted_dir  = $this->wau_get_encrypted_upload_directory( true );
+                                $encrypted_path = $encrypted_dir['path'];
+                        }
+
+                        if ( ( $private_path && ! $wp_filesystem ) || ( empty( $private_path ) && empty( $encrypted_path ) ) ) {
+                                delete_transient( 'wau_legacy_upload_migration_lock' );
                                 return;
                         }
@@ -207 +223 @@
                                 $directory = new DirectoryIterator( $legacy_path );
                         } catch ( Exception $exception ) {
+                                delete_transient( 'wau_legacy_upload_migration_lock' );
                                 return;
                         }
@@ -217 +234 @@
                                 $file_name = $file_info->getFilename();
 
-                                if ( in_array( strtolower( $file_name ), array( '.htaccess', 'web.config', 'index.php' ), true ) ) {
+                                if ( in_array( strtolower( $file_name ), array( '.htaccess', 'web.config', 'index.php' ), true ) || '.wau-pending' === substr( $file_name, -12 ) ) {
                                         continue;
                                 }
@@ -226 +243 @@
                                 }
 
-                                $source      = trailingslashit( $legacy_path ) . $file_name;
+                                $source = trailingslashit( $legacy_path ) . $file_name;
+
+                                if ( empty( $private_path ) ) {
+                                        if ( $this->wau_encrypt_and_verify_file( $source, $file_name ) ) {
+                                                wp_delete_file( $source );
+                                                wp_delete_file( $source . '.wau-pending' );
+                                                $migrated++;
+                                        } else {
+                                                $remaining = true;
+                                        }
+                                        continue;
+                                }
+
                                 $destination = trailingslashit( $private_path ) . $file_name;
 
@@ -251 +280 @@
                                 update_option( 'wau_legacy_upload_migration_complete', current_time( 'mysql' ), false );
                         }
+
+                        delete_transient( 'wau_legacy_upload_migration_lock' );
                 }
 
@@ -335 +366 @@
 
                 /**
+                 * Get the public directory used only for authenticated encrypted containers.
+                 *
+                 * The files in this directory contain authenticated ciphertext and use opaque
+                 * names. Plaintext is never written here.
+                 *
+                 * @param bool $create Whether to create and protect the directory.
+                 * @return array
+                 */
+                private function wau_get_encrypted_upload_directory( $create = false ) {
+                        $legacy_dir = $this->wau_get_legacy_upload_directory();
+
+                        if ( empty( $legacy_dir['path'] ) || ! $this->wau_encryption_is_available() ) {
+                                return array( 'path' => '', 'url' => '' );
+                        }
+
+                        $site_key  = $this->wau_get_site_storage_key();
+                        $directory = trailingslashit( $legacy_dir['path'] ) . 'encrypted/' . $site_key . '/';
+
+                        if ( $create ) {
+                                $this->wau_ensure_upload_directory_protection( true );
+
+                                if ( ! $this->wau_prepare_upload_directory( $directory ) || ! $this->wau_get_encryption_key( true ) ) {
+                                        return array( 'path' => '', 'url' => '' );
+                                }
+
+                                $this->wau_write_storage_protection_files( $directory );
+                        }
+
+                        return array(
+                                'path' => $directory,
+                                'url'  => trailingslashit( $legacy_dir['url'] ) . 'encrypted/' . $site_key . '/',
+                        );
+                }
+
+                /**
+                 * Check whether an authenticated encryption implementation is available.
+                 *
+                 * @return bool
+                 */
+                private function wau_encryption_is_available() {
+                        $sodium_available = function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_push' )
+                                && function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_pull' );
+                        $openssl_available = function_exists( 'openssl_encrypt' )
+                                && function_exists( 'openssl_decrypt' )
+                                && in_array( 'aes-256-gcm', openssl_get_cipher_methods(), true );
+
+                        return $sodium_available || $openssl_available;
+                }
+
+                /**
+                 * Get or create this site's encryption key.
+                 *
+                 * @param bool $create Whether to create a key when no encrypted files exist.
+                 * @return string|false Raw 32-byte key, or false.
+                 */
+                private function wau_get_encryption_key( $create = false ) {
+                        $encoded_key = get_option( 'wau_encryption_key', '' );
+                        $key         = is_string( $encoded_key ) ? base64_decode( $encoded_key, true ) : false;
+
+                        if ( is_string( $key ) && 32 === strlen( $key ) ) {
+                                return $key;
+                        }
+
+                        if ( ! $create ) {
+                                return false;
+                        }
+
+                        $legacy_dir    = $this->wau_get_legacy_upload_directory();
+                        $encrypted_dir = ! empty( $legacy_dir['path'] ) ? trailingslashit( $legacy_dir['path'] ) . 'encrypted/' . $this->wau_get_site_storage_key() . '/' : '';
+                        if ( $encrypted_dir && is_dir( $encrypted_dir ) ) {
+                                try {
+                                        $directory = new DirectoryIterator( $encrypted_dir );
+                                        foreach ( $directory as $file_info ) {
+                                                if ( ! $file_info->isDot() && $file_info->isFile() && '.wau' === strtolower( substr( $file_info->getFilename(), -4 ) ) ) {
+                                                        return false;
+                                                }
+                                        }
+                                } catch ( Exception $exception ) {
+                                        return false;
+                                }
+                        }
+
+                        try {
+                                $new_key = random_bytes( 32 );
+                        } catch ( Throwable $exception ) {
+                                return false;
+                        }
+
+                        $encoded_new_key = base64_encode( $new_key );
+                        if ( ! add_option( 'wau_encryption_key', $encoded_new_key, '', false ) ) {
+                                $existing_key = get_option( 'wau_encryption_key', '' );
+                                $decoded_key  = is_string( $existing_key ) ? base64_decode( $existing_key, true ) : false;
+
+                                if ( is_string( $decoded_key ) && 32 === strlen( $decoded_key ) ) {
+                                        return $decoded_key;
+                                }
+
+                                update_option( 'wau_encryption_key', $encoded_new_key, false );
+                        }
+                        $encoded_key = get_option( 'wau_encryption_key', '' );
+                        $key         = is_string( $encoded_key ) ? base64_decode( $encoded_key, true ) : false;
+
+                        return is_string( $key ) && 32 === strlen( $key ) ? $key : false;
+                }
+
+                /**
+                 * Resolve the opaque encrypted-container path for a logical filename.
+                 *
+                 * @param string $file_name        Logical filename stored in cart/order data.
+                 * @param bool   $create_directory Whether to create the fallback directory.
+                 * @return string|false
+                 */
+                private function wau_get_encrypted_file_path( $file_name, $create_directory = false ) {
+                        $safe_filename = sanitize_file_name( basename( $file_name ) );
+                        $directory     = $this->wau_get_encrypted_upload_directory( $create_directory );
+                        $key           = $this->wau_get_encryption_key( $create_directory );
+
+                        if ( empty( $safe_filename ) || empty( $directory['path'] ) || ! $key ) {
+                                return false;
+                        }
+
+                        $opaque_name = substr( hash_hmac( 'sha256', $safe_filename, $key ), 0, 40 ) . '.wau';
+
+                        return trailingslashit( $directory['path'] ) . $opaque_name;
+                }
+
+                /**
+                 * Encrypt a plaintext file and verify it before the caller removes the source.
+                 *
+                 * @param string $source_path Plaintext source path.
+                 * @param string $file_name   Logical filename.
+                 * @return bool
+                 */
+                private function wau_encrypt_and_verify_file( $source_path, $file_name ) {
+                        if ( ! is_file( $source_path ) ) {
+                                return false;
+                        }
+
+                        $destination = $this->wau_get_encrypted_file_path( $file_name, true );
+                        $source_hash = @hash_file( 'sha256', $source_path ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        $source_size = @filesize( $source_path ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+
+                        if ( ! $destination || false === $source_hash || false === $source_size ) {
+                                return false;
+                        }
+
+                        if ( file_exists( $destination ) && $this->wau_verify_encrypted_file( $destination, $file_name, $source_hash, $source_size ) ) {
+                                return true;
+                        }
+
+                        try {
+                                $temp_path = $destination . '.tmp-' . bin2hex( random_bytes( 4 ) );
+                        } catch ( Throwable $exception ) {
+                                return false;
+                        }
+
+                        if ( ! $this->wau_encrypt_file( $source_path, $temp_path, $file_name, $source_size )
+                                || ! $this->wau_verify_encrypted_file( $temp_path, $file_name, $source_hash, $source_size ) ) {
+                                wp_delete_file( $temp_path );
+                                return false;
+                        }
+
+                        if ( file_exists( $destination ) ) {
+                                wp_delete_file( $destination );
+                        }
+
+                        if ( ! @rename( $temp_path, $destination ) ) { // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                                wp_delete_file( $temp_path );
+                                return false;
+                        }
+
+                        return $this->wau_verify_encrypted_file( $destination, $file_name, $source_hash, $source_size );
+                }
+
+                /**
+                 * Write a versioned authenticated-encryption container.
+                 *
+                 * @param string $source_path      Plaintext source path.
+                 * @param string $destination_path Container destination path.
+                 * @param string $file_name        Logical filename.
+                 * @param int    $plain_size       Plaintext byte size.
+                 * @return bool
+                 */
+                private function wau_encrypt_file( $source_path, $destination_path, $file_name, $plain_size ) {
+                        $key = $this->wau_get_encryption_key( true );
+
+                        if ( ! $key ) {
+                                return false;
+                        }
+
+                        $use_sodium = function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_push' );
+                        $algorithm  = $use_sodium ? 'S' : 'O';
+                        $prefix     = self::WAU_ENCRYPTED_FILE_MAGIC . $algorithm . str_pad( (string) $plain_size, 20, '0', STR_PAD_LEFT );
+                        $input      = @fopen( $source_path, 'rb' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        $output     = @fopen( $destination_path, 'xb' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+
+                        if ( ! $input || ! $output || ! $this->wau_write_all( $output, $prefix ) ) {
+                                if ( is_resource( $input ) ) {
+                                        fclose( $input );
+                                }
+                                if ( is_resource( $output ) ) {
+                                        fclose( $output );
+                                }
+                                return false;
+                        }
+
+                        try {
+                                $success = $use_sodium
+                                        ? $this->wau_encrypt_stream_sodium( $input, $output, $key, $prefix, $file_name )
+                                        : $this->wau_encrypt_stream_openssl( $input, $output, $key, $prefix, $file_name );
+                        } catch ( Throwable $exception ) {
+                                $success = false;
+                        }
+
+                        fclose( $input );
+                        fclose( $output );
+
+                        return $success;
+                }
+
+                /**
+                 * Encrypt a stream with libsodium secretstream.
+                 */
+                private function wau_encrypt_stream_sodium( $input, $output, $key, $prefix, $file_name ) {
+                        list( $state, $header ) = sodium_crypto_secretstream_xchacha20poly1305_init_push( $key );
+
+                        if ( ! $this->wau_write_all( $output, $header ) ) {
+                                return false;
+                        }
+
+                        $current = fread( $input, self::WAU_ENCRYPTED_CHUNK_SIZE );
+                        if ( false === $current ) {
+                                return false;
+                        }
+
+                        do {
+                                $next = feof( $input ) ? '' : fread( $input, self::WAU_ENCRYPTED_CHUNK_SIZE );
+                                if ( false === $next ) {
+                                        return false;
+                                }
+
+                                $is_final   = feof( $input ) && '' === $next;
+                                $tag        = $is_final ? SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_FINAL : SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_MESSAGE;
+                                $ciphertext = sodium_crypto_secretstream_xchacha20poly1305_push( $state, $current, $prefix . $file_name, $tag );
+
+                                if ( ! $this->wau_write_all( $output, pack( 'N', strlen( $ciphertext ) ) . $ciphertext ) ) {
+                                        return false;
+                                }
+
+                                $current = $next;
+                        } while ( ! $is_final );
+
+                        return true;
+                }
+
+                /**
+                 * Encrypt a stream with independently authenticated AES-256-GCM records.
+                 */
+                private function wau_encrypt_stream_openssl( $input, $output, $key, $prefix, $file_name ) {
+                        if ( ! function_exists( 'openssl_encrypt' ) || ! in_array( 'aes-256-gcm', openssl_get_cipher_methods(), true ) ) {
+                                return false;
+                        }
+
+                        $current = fread( $input, self::WAU_ENCRYPTED_CHUNK_SIZE );
+                        $index   = 0;
+                        if ( false === $current ) {
+                                return false;
+                        }
+
+                        do {
+                                $next = feof( $input ) ? '' : fread( $input, self::WAU_ENCRYPTED_CHUNK_SIZE );
+                                if ( false === $next ) {
+                                        return false;
+                                }
+
+                                $is_final = feof( $input ) && '' === $next;
+                                $flags    = $is_final ? "\x01" : "\x00";
+                                $length   = pack( 'N', strlen( $current ) );
+                                $iv       = random_bytes( 12 );
+                                $tag      = '';
+                                $aad      = $prefix . $file_name . pack( 'N', $index ) . $flags . $length;
+                                $ciphertext = openssl_encrypt( $current, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag, $aad, 16 );
+
+                                if ( false === $ciphertext || 16 !== strlen( $tag ) || ! $this->wau_write_all( $output, $flags . $length . $iv . $tag . $ciphertext ) ) {
+                                        return false;
+                                }
+
+                                $current = $next;
+                                $index++;
+                        } while ( ! $is_final );
+
+                        return true;
+                }
+
+                /**
+                 * Verify an encrypted file against the original content details.
+                 */
+                private function wau_verify_encrypted_file( $file_path, $file_name, $expected_hash, $expected_size ) {
+                        $hash_context = hash_init( 'sha256' );
+                        $actual_size  = 0;
+                        $success      = $this->wau_read_encrypted_file(
+                                $file_path,
+                                $file_name,
+                                function ( $chunk ) use ( $hash_context, &$actual_size ) {
+                                        hash_update( $hash_context, $chunk );
+                                        $actual_size += strlen( $chunk );
+                                        return true;
+                                }
+                        );
+
+                        $actual_hash = hash_final( $hash_context );
+
+                        return $success && (int) $expected_size === $actual_size && hash_equals( $expected_hash, $actual_hash );
+                }
+
+                /**
+                 * Read and authenticate an encrypted container chunk by chunk.
+                 *
+                 * @param string   $file_path Container path.
+                 * @param string   $file_name Logical filename.
+                 * @param callable $consumer  Receives each plaintext chunk.
+                 * @return bool
+                 */
+                private function wau_read_encrypted_file( $file_path, $file_name, $consumer ) {
+                        $key    = $this->wau_get_encryption_key();
+                        $handle = @fopen( $file_path, 'rb' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+
+                        if ( ! $key || ! $handle ) {
+                                return false;
+                        }
+
+                        $prefix = $this->wau_read_exact( $handle, 29 );
+                        if ( false === $prefix || self::WAU_ENCRYPTED_FILE_MAGIC !== substr( $prefix, 0, 8 ) || ! ctype_digit( substr( $prefix, 9, 20 ) ) ) {
+                                fclose( $handle );
+                                return false;
+                        }
+
+                        $algorithm   = substr( $prefix, 8, 1 );
+                        $expected_size = (int) ltrim( substr( $prefix, 9, 20 ), '0' );
+                        $total_size  = 0;
+                        $success     = 'S' === $algorithm
+                                ? $this->wau_decrypt_stream_sodium( $handle, $key, $prefix, $file_name, $consumer, $total_size )
+                                : ( 'O' === $algorithm ? $this->wau_decrypt_stream_openssl( $handle, $key, $prefix, $file_name, $consumer, $total_size ) : false );
+
+                        fclose( $handle );
+
+                        return $success && $expected_size === $total_size;
+                }
+
+                /**
+                 * Decrypt a libsodium container stream.
+                 */
+                private function wau_decrypt_stream_sodium( $handle, $key, $prefix, $file_name, $consumer, &$total_size ) {
+                        if ( ! function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_pull' ) ) {
+                                return false;
+                        }
+
+                        $header = $this->wau_read_exact( $handle, SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES );
+                        if ( false === $header ) {
+                                return false;
+                        }
+
+                        $state = sodium_crypto_secretstream_xchacha20poly1305_init_pull( $header, $key );
+                        while ( true ) {
+                                $packed_length = $this->wau_read_exact( $handle, 4 );
+                                if ( false === $packed_length ) {
+                                        return false;
+                                }
+
+                                $length = unpack( 'Nlength', $packed_length )['length'];
+                                if ( $length > self::WAU_ENCRYPTED_CHUNK_SIZE + SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_ABYTES ) {
+                                        return false;
+                                }
+
+                                $ciphertext = $this->wau_read_exact( $handle, $length );
+                                $result     = false === $ciphertext ? false : sodium_crypto_secretstream_xchacha20poly1305_pull( $state, $ciphertext, $prefix . $file_name );
+                                if ( false === $result ) {
+                                        return false;
+                                }
+
+                                list( $plaintext, $tag ) = $result;
+                                $total_size += strlen( $plaintext );
+                                if ( false === call_user_func( $consumer, $plaintext ) ) {
+                                        return false;
+                                }
+
+                                if ( SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_FINAL === $tag ) {
+                                        return '' === fread( $handle, 1 );
+                                }
+                        }
+                }
+
+                /**
+                 * Decrypt an AES-256-GCM container stream.
+                 */
+                private function wau_decrypt_stream_openssl( $handle, $key, $prefix, $file_name, $consumer, &$total_size ) {
+                        if ( ! function_exists( 'openssl_decrypt' ) ) {
+                                return false;
+                        }
+
+                        $index = 0;
+                        while ( true ) {
+                                $flags  = $this->wau_read_exact( $handle, 1 );
+                                $length = $this->wau_read_exact( $handle, 4 );
+                                if ( false === $flags || false === $length || ( "\x00" !== $flags && "\x01" !== $flags ) ) {
+                                        return false;
+                                }
+
+                                $plain_length = unpack( 'Nlength', $length )['length'];
+                                if ( $plain_length > self::WAU_ENCRYPTED_CHUNK_SIZE ) {
+                                        return false;
+                                }
+
+                                $iv         = $this->wau_read_exact( $handle, 12 );
+                                $tag        = $this->wau_read_exact( $handle, 16 );
+                                $ciphertext = $this->wau_read_exact( $handle, $plain_length );
+                                if ( false === $iv || false === $tag || false === $ciphertext ) {
+                                        return false;
+                                }
+
+                                $aad       = $prefix . $file_name . pack( 'N', $index ) . $flags . $length;
+                                $plaintext = openssl_decrypt( $ciphertext, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag, $aad );
+                                if ( false === $plaintext || strlen( $plaintext ) !== $plain_length ) {
+                                        return false;
+                                }
+
+                                $total_size += strlen( $plaintext );
+                                if ( false === call_user_func( $consumer, $plaintext ) ) {
+                                        return false;
+                                }
+
+                                if ( "\x01" === $flags ) {
+                                        return '' === fread( $handle, 1 );
+                                }
+
+                                $index++;
+                        }
+                }
+
+                /**
+                 * Read exactly the requested number of bytes from a file handle.
+                 */
+                private function wau_read_exact( $handle, $length ) {
+                        $data = '';
+
+                        while ( strlen( $data ) < $length && ! feof( $handle ) ) {
+                                $chunk = fread( $handle, $length - strlen( $data ) );
+                                if ( false === $chunk || '' === $chunk ) {
+                                        break;
+                                }
+                                $data .= $chunk;
+                        }
+
+                        return strlen( $data ) === $length ? $data : false;
+                }
+
+                /**
+                 * Write all bytes to a file handle.
+                 */
+                private function wau_write_all( $handle, $data ) {
+                        $written = 0;
+                        $length  = strlen( $data );
+
+                        while ( $written < $length ) {
+                                $result = fwrite( $handle, substr( $data, $written ) );
+                                if ( false === $result || 0 === $result ) {
+                                        return false;
+                                }
+                                $written += $result;
+                        }
+
+                        return true;
+                }
+
+                /**
+                 * Read encrypted-container metadata without decrypting its contents.
+                 *
+                 * @return array|false
+                 */
+                private function wau_get_encrypted_file_metadata( $file_path ) {
+                        if ( '.wau' !== strtolower( substr( $file_path, -4 ) ) ) {
+                                return false;
+                        }
+
+                        $handle = @fopen( $file_path, 'rb' ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        if ( ! $handle ) {
+                                return false;
+                        }
+
+                        $prefix = $this->wau_read_exact( $handle, 29 );
+                        fclose( $handle );
+
+                        if ( false === $prefix || self::WAU_ENCRYPTED_FILE_MAGIC !== substr( $prefix, 0, 8 ) || ! ctype_digit( substr( $prefix, 9, 20 ) ) ) {
+                                return false;
+                        }
+
+                        return array(
+                                'algorithm' => substr( $prefix, 8, 1 ),
+                                'size'      => (int) ltrim( substr( $prefix, 9, 20 ), '0' ),
+                        );
+                }
+
+                /**
                  * Get the preferred private upload directory for this site.
                  *
@@ -413 +947 @@
                                         'url'     => '',
                                         'storage' => 'private',
+                                );
+                        }
+
+                        $encrypted_upload_dir = $this->wau_get_encrypted_upload_directory( true );
+                        if ( ! empty( $encrypted_upload_dir['path'] ) ) {
+                                return array(
+                                        'path'    => $encrypted_upload_dir['path'],
+                                        'url'     => '',
+                                        'storage' => 'encrypted',
                                 );
                         }
@@ -587 +1130 @@
                         global $wp_filesystem;
 
-                        if ( $wp_filesystem && $this->wau_is_allowed_upload_path( $file_path ) ) {
+                        if ( ! $this->wau_is_allowed_upload_path( $file_path ) ) {
+                                return;
+                        }
+
+                        if ( $wp_filesystem ) {
                                 $wp_filesystem->put_contents( $file_path . '.wau-pending', (string) time(), FS_CHMOD_FILE );
+                        } else {
+                                @file_put_contents( $file_path . '.wau-pending', (string) time(), LOCK_EX ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged, WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
                         }
                 }
@@ -616 +1165 @@
                         }
 
-                        $private_upload_dir = $this->wau_get_private_upload_directory();
-                        if ( empty( $private_upload_dir['path'] ) || ! is_dir( $private_upload_dir['path'] ) ) {
+                        $private_upload_dir   = $this->wau_get_private_upload_directory();
+                        $encrypted_upload_dir = $this->wau_get_encrypted_upload_directory();
+                        $cleanup_directories  = array_filter(
+                                array(
+                                        $private_upload_dir['path'],
+                                        $encrypted_upload_dir['path'],
+                                )
+                        );
+
+                        if ( empty( $cleanup_directories ) ) {
                                 return;
                         }
@@ -629 +1186 @@
                         $cutoff    = time() - $retention;
 
-                        try {
-                                $directory = new DirectoryIterator( $private_upload_dir['path'] );
-                        } catch ( Exception $exception ) {
-                                return;
-                        }
-
-                        foreach ( $directory as $file_info ) {
-                                $file_name = $file_info->getFilename();
-
-                                if ( $file_info->isDot() || ! $file_info->isFile() || '.wau-pending' !== substr( $file_name, -12 ) ) {
+                        foreach ( $cleanup_directories as $cleanup_directory ) {
+                                if ( ! is_dir( $cleanup_directory ) ) {
                                         continue;
                                 }
 
-                                $marker_path = $file_info->getPathname();
-                                if ( $file_info->getMTime() > $cutoff ) {
+                                try {
+                                        $directory = new DirectoryIterator( $cleanup_directory );
+                                } catch ( Exception $exception ) {
                                         continue;
                                 }
 
-                                $upload_path = substr( $marker_path, 0, -12 );
-                                if ( file_exists( $upload_path ) && $this->wau_is_allowed_upload_path( $upload_path ) ) {
-                                        wp_delete_file( $upload_path );
-                                }
-
-                                wp_delete_file( $marker_path );
+                                foreach ( $directory as $file_info ) {
+                                        $file_name = $file_info->getFilename();
+
+                                        if ( $file_info->isDot() || ! $file_info->isFile() || '.wau-pending' !== substr( $file_name, -12 ) ) {
+                                                continue;
+                                        }
+
+                                        $marker_path = $file_info->getPathname();
+                                        if ( $file_info->getMTime() > $cutoff ) {
+                                                continue;
+                                        }
+
+                                        $upload_path = substr( $marker_path, 0, -12 );
+                                        if ( file_exists( $upload_path ) && $this->wau_is_allowed_upload_path( $upload_path ) ) {
+                                                wp_delete_file( $upload_path );
+                                        }
+
+                                        wp_delete_file( $marker_path );
+                                }
                         }
                 }
@@ -795 +1358 @@
                         WP_Filesystem();
 
-                        if ( ! $wp_filesystem ) {
-                                wc_add_notice( __( 'File upload failed. Please try again.', 'woo-addon-uploads' ), 'error' );
-                                return $cart_item_meta;
-                        }
-
                         // Check if file is uploaded.
                         $post_file = wp_unslash( $_FILES );
@@ -889 +1447 @@
                                 // Ensure directory exists.
                                 if ( empty( $custom_dir ) || ! $this->wau_prepare_upload_directory( $custom_dir ) ) {
-                                        wc_add_notice( __( 'File upload is temporarily unavailable because private upload storage could not be created. Please contact the store administrator.', 'woo-addon-uploads' ), 'error' );
+                                        wc_add_notice( __( 'File upload is temporarily unavailable because secure upload storage could not be created. Please contact the store administrator.', 'woo-addon-uploads' ), 'error' );
                                         return $cart_item_meta;
                                 }
@@ -897 +1455 @@
                                 if ( false !== $free_space && $free_space - $actual_size < $minimum_free_space ) {
                                         wc_add_notice( __( 'File upload is temporarily unavailable because the server is low on storage space.', 'woo-addon-uploads' ), 'error' );
+                                        return $cart_item_meta;
+                                }
+
+                                if ( 'encrypted' === $storage_dir['storage'] ) {
+                                        $original_name = sanitize_file_name( basename( (string) $file['name'] ) );
+                                        $original_name = $original_name ? $original_name : 'upload.' . $file_ext;
+
+                                        try {
+                                                $file_name = bin2hex( random_bytes( 16 ) ) . '-' . time() . '-' . $original_name;
+                                        } catch ( Throwable $exception ) {
+                                                wc_add_notice( __( 'File upload failed. Please try again.', 'woo-addon-uploads' ), 'error' );
+                                                return $cart_item_meta;
+                                        }
+
+                                        $encrypted_path = $this->wau_get_encrypted_file_path( $file_name, true );
+                                        if ( ! $encrypted_path || ! $this->wau_encrypt_and_verify_file( $tmp_name, $file_name ) ) {
+                                                wc_add_notice( __( 'File upload failed while creating secure encrypted storage. Please try again.', 'woo-addon-uploads' ), 'error' );
+                                                return $cart_item_meta;
+                                        }
+
+                                        $access_key = wp_generate_password( 32, false, false );
+                                        $addon_id   = array(
+                                                'file_path'  => $encrypted_path,
+                                                'file_url'   => '',
+                                                'file_name'  => $file_name,
+                                                'storage'    => 'encrypted',
+                                                'access_key' => $access_key,
+                                        );
+                                        $this->wau_mark_upload_pending( $encrypted_path );
+                                        $cart_item_meta['wau_addon_ids'][] = $addon_id;
+
+                                        return $cart_item_meta;
+                                }
+
+                                if ( ! $wp_filesystem ) {
+                                        wc_add_notice( __( 'File upload failed. Please try again.', 'woo-addon-uploads' ), 'error' );
                                         return $cart_item_meta;
                                 }
@@ -1478 +2072 @@
                         }
 
+                        $encrypted_path = $this->wau_get_encrypted_file_path( $safe_filename );
+                        if ( $encrypted_path && file_exists( $encrypted_path ) && is_file( $encrypted_path ) && $this->wau_is_allowed_upload_path( $encrypted_path ) ) {
+                                return $encrypted_path;
+                        }
+
                         return false;
                 }
@@ -1492 +2091 @@
                         $private_upload_dir = $this->wau_get_private_upload_directory();
                         $legacy_upload_dir  = $this->wau_get_legacy_upload_directory();
+                        $encrypted_upload_dir = $this->wau_get_encrypted_upload_directory();
                         $directories        = array();
 
@@ -1500 +2100 @@
                         if ( ! empty( $legacy_upload_dir['path'] ) ) {
                                 $directories[] = $legacy_upload_dir['path'];
+                        }
+
+                        if ( ! empty( $encrypted_upload_dir['path'] ) ) {
+                                $directories[] = $encrypted_upload_dir['path'];
                         }
 
@@ -1558 +2162 @@
                                 }
 
-                                $file_path     = $this->wau_locate_uploaded_file( $safe_filename );
+                                $file_path = $this->wau_locate_uploaded_file( $safe_filename );
 
                                 // 2. Clear any active output buffers to prevent file corruption/whitespace injections
@@ -1566 +2170 @@
 
                                 if ( $file_path && file_exists( $file_path ) ) {
-                                        $filetype  = wp_check_filetype( $file_path );
+                                        $filetype  = wp_check_filetype( $safe_filename );
                                         $mime_type = $filetype['type'] ? $filetype['type'] : 'application/octet-stream';
+                                        $encrypted_metadata = $this->wau_get_encrypted_file_metadata( $file_path );
+                                        if ( $encrypted_metadata ) {
+                                                $is_valid = $this->wau_read_encrypted_file(
+                                                        $file_path,
+                                                        $safe_filename,
+                                                        function () {
+                                                                return true;
+                                                        }
+                                                );
+
+                                                if ( ! $is_valid ) {
+                                                        wp_die( esc_html__( 'The encrypted file could not be authenticated.', 'woo-addon-uploads' ) );
+                                                }
+                                        }
 
                                         // Only known passive raster formats may render inline. Other formats are downloads.
@@ -1575 +2193 @@
 
                                         send_nosniff_header();
+                                        nocache_headers();
                                         header( 'Content-Type: ' . $mime_type );
-                                        header( 'Content-Disposition: ' . $disposition . '; filename="' . basename( $file_path ) . '"' );
-                                        header( 'Content-Length: ' . filesize( $file_path ) );
-                                        readfile( $file_path ); // phpcs:ignore
+                                        header( 'Content-Disposition: ' . $disposition . '; filename="' . $safe_filename . '"' );
+
+                                        if ( $encrypted_metadata ) {
+                                                header( 'Content-Length: ' . $encrypted_metadata['size'] );
+                                                $this->wau_read_encrypted_file(
+                                                        $file_path,
+                                                        $safe_filename,
+                                                        function ( $chunk ) {
+                                                                echo $chunk; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+                                                                return ! connection_aborted();
+                                                        }
+                                                );
+                                        } else {
+                                                header( 'Content-Length: ' . filesize( $file_path ) );
+                                                readfile( $file_path ); // phpcs:ignore
+                                        }
                                         exit;
                                 } else {

woo-addon-uploads/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 5.0
 Tested up to: 7.1
-Stable tag: 1.7.6
+Stable tag: 1.7.7
 Requires PHP: 7.4
 License: GPLv2 or later
@@ -143 +143 @@
 == Changelog ==
 
+= 1.7.7 (09.10.2026) =
+* Security fix: Encrypt legacy public uploads with authenticated encryption when private filesystem storage cannot be created, then remove the verified plaintext originals.
+* Security fix: Store new uploads directly as opaque encrypted containers when private filesystem storage is unavailable, without writing plaintext into the public uploads folder.
+* Reliability fix: Verify each encrypted migration by byte size and SHA-256 before deleting its public plaintext source.
+* System Status: Report encrypted fallback availability, encrypted container totals, and the number of public plaintext files still awaiting migration.
+
 = 1.7.6 (26.09.2026) =
 * Security fix: Prevent new uploads from falling back to the public uploads directory when private storage is unavailable.
@@ -260 +266 @@
 = What happens if my host does not allow private upload storage? =
 
-Some shared or managed hosts do not allow WordPress to create folders outside the public web root. If private storage is not available, new customer uploads are paused instead of being stored in a public web-accessible folder.
-
-For files uploaded before this update, the plugin continues to harden the legacy folder's `.htaccess` and `web.config` protection files where supported. On Nginx, Caddy, OpenLiteSpeed, or similar servers, directory-level `.htaccess` files may not be honored, so your host may need to block direct web access to:
+Some shared or managed hosts do not allow WordPress to create folders outside the public web root. If private storage is not available, the plugin stores new uploads as authenticated encrypted containers with opaque names under:
+
+`
+/wp-content/uploads/wau-uploads/encrypted/<site-specific-folder>/
+`
+
+The site-specific folder uses the site host, blog ID, and a short hash so subdomain and multisite stores do not share encrypted storage. The original customer filename is not used as the container filename, and plaintext upload contents are never written to that directory. Direct requests can retrieve only authenticated ciphertext, which is decrypted exclusively by the plugin's authorized download handler.
+
+Files uploaded before this update are moved to private storage when available. Otherwise, they are encrypted and verified in small batches, and each public plaintext original is deleted only after its encrypted copy matches the original byte size and SHA-256 hash.
+
+While public plaintext files are still awaiting migration, the plugin continues to harden the legacy folder's `.htaccess` and `web.config` protection files where supported. On Nginx, Caddy, OpenLiteSpeed, or similar servers, directory-level `.htaccess` files may not be honored, so your host should temporarily block direct web access to:
 
 `
@@ -280 +294 @@
 OpenLiteSpeed and Caddy use different configuration formats; share the displayed URL path with your host instead of copying the Nginx rule.
 
-On Apache or LiteSpeed, the protection file can be present even when the server is configured to ignore it. While legacy files remain, test a known legacy file URL and confirm that it returns HTTP 403 or 404. The System Status page keeps this verification visible until migration is complete.
+On Apache or LiteSpeed, the protection file can be present even when the server is configured to ignore it. While public plaintext files remain, test a known legacy file URL and confirm that it returns HTTP 403 or 404. The System Status page keeps this verification visible until migration is complete.
 
 You can also review the current storage status and recommended action items from WooCommerce admin under Addon Upload Settings > System Status.
@@ -298 +312 @@
 = What happens to files uploaded before this update? =
 
-Existing files in `wp-content/uploads/wau-uploads/` remain accessible to authorized users through the plugin's secure download handler. When private storage is available, the plugin migrates legacy files to the private folder in small batches during normal site activity.
+Existing files in `wp-content/uploads/wau-uploads/` remain accessible to authorized users through the plugin's secure download handler. The plugin migrates them in small batches during normal site activity. It moves them outside the web root when private storage is available; otherwise, it converts them into opaque authenticated encrypted containers and deletes the verified public plaintext originals.
 
 Existing order links that already use the plugin's secure download handler continue to work. Older direct links to `/wau-uploads/` are rewritten to secure download links when displayed in order metadata.
@@ -304 +318 @@
 Logged-in customers are authorized through order ownership. Guest customers are authorized using the WooCommerce order key included in their generated download link. Each new upload also has its own access key.
 
+The encryption key is stored in the WordPress database and is not embedded in the encrypted files. Back up the WordPress database and uploaded files together; encrypted fallback files cannot be recovered without that database key.
+
 = What file types are supported? =
 

woo-addon-uploads/trunk/woocommerce-addon-uploads.php

@@ -4 +4 @@
  * Plugin URI: https://imaginate-solutions.com/downloads/woocommerce-addon-uploads/
  * Description: WooCommerce addon to upload additional files before adding product to cart
- * Version: 1.7.6
+ * Version: 1.7.7
  * Author: Imaginate Solutions
  * Author URI: https://imaginate-solutions.com
@@ -45 +45 @@
                  * @var      string    $version    The current version of the plugin.
                  */
-                protected $version = '1.7.6';
+                protected $version = '1.7.7';
 
                 /**