Webhook race condition marks successful order as Failed

[rasmusjaa]

Describe the bug

When a customer fails an initial payment attempt and then immediately retries and succeeds, the order ends up stuck in Failed status despite the payment being fully processed and charged. The root cause appears to be a delayed or out-of-order webhook from Paytrail's gateway: the failure notification from the first attempt arrives after the second attempt has already been confirmed as successful.

Steps to Reproduce

1. Customer initiates checkout and pays with Mastercard → payment is declined
2. Customer retries immediately using the same or a different card → payment succeeds
3. WooCommerce receives the success callback and moves the order to Processing
4. Stock is decremented (in this case going to -1, triggering a move to Backordered)
5. Shortly after (~1 minute), a delayed failure webhook from the first payment attempt arrives
6. The plugin processes this webhook and moves the order from Backordered → Failed

Expected behaviour

Once an order has reached Processing (or any post-payment status), incoming failure webhooks referencing an older, different transaction ID should be ignored. The plugin should not allow a stale failure notification to override a confirmed successful payment.

Before processing any failure webhook, the plugin should check whether the order already has a completed payment transaction ID recorded. If the incoming webhook's transaction ID differs from the one already stored on the order, the webhook should be discarded (or logged as informational) rather than applied.

Actual behaviour

Order ends up in Failed status even though a valid successful payment transaction exists. The order note log shows:

[16:46] Payment created with provider Mastercard (ID: c47...)
[16:46] Payment failed.
[16:46] Order status: Pending payment → Failed
[16:49] Payment created with provider Mastercard (ID: 88c...)
[16:49] Payment completed with transaction ID 88c...
[16:49] Order status: Failed → Processing
[16:49] Stock decremented: 0 → -1
[16:49] Order status: Processing → Backordered
[16:50] Payment failed.   ← stale webhook from first attempt
[16:50] Order status: Backordered → Failed   ← incorrectly overrides successful state

• The customer has been charged successfully, but the order appears failed to the merchant
• No fulfillment is triggered; the merchant must manually correct the order status
• Stock level is left incorrect
• This is a silent issue — nothing alerts the merchant that the order needs attention

[kotivuori]

Thanks for reporting @rasmusjaa, we will take a look at this

[krokedilmartin]

Hello @rasmusjaa

I am not able to recreate this issue. Could you please send some more information to support@krokedil.se ?

A screenshot of the order in WooCommerce that should include the order notes, if an order was created. You can follow this guide.

A system report by following this guide.

The entire Paytrail plugin's log from the same day when the order was created/the issue appeared, follow this guide on where to find the log.
https://docs.krokedil.com/krokedil-general-support-info/prepare-a-support-ticket/#3-logs
Please note, you must have had enabled logging in the plugin's settings to be able to find the log. You can also send along the fatal error log if there is one from the same day.