Thursday, October 15, 2026
News For Internet Marketers
NMI's Classic API Migration Playbook moves server-side payments from /api/transact.php to JSON endpoints such as POST /api/v5/payments/sale, with the private key alone in the Authorization header and errors returned as HTTP status codes. Keys and Collect.js tokens carry over, and the classic API stays supported.
WooCommerce 11.2 adds a date field type to the Additional Checkout Fields API, letting Checkout block stores collect a birth date and reject underage birthdays with relative limits such as -P21Y. The field is self-reported, so vape sellers still need PACT Act database verification.
Public Law 119-103 delays most of the federal hemp redefinition to December 11, 2026, but Missouri HB 2641 and Illinois Public Act 104-463 still take effect November 12, forcing earlier cart blocks and licensed-channel rules for intoxicating hemp SKUs.
Visa Compelling Evidence 3.0 under Dispute Condition 10.4 expands on October 24, 2026 to prior purchases on the same card or associated tokens, including across merchants an acquirer processed, when qualifying data elements match.
ATF's October 9, 2026 Open Letter ends enforcement of NFA approval and registration for suppressors, short-barreled rifles and shotguns, and any other weapons, but special occupational taxes, Gun Control Act duties, and state laws still govern online FFL sales.
Acquirers in California, Colorado, and New York must assign MCC 5723 to qualifying gun retailers, while Texas, Florida, Kentucky, Arkansas, and other states ban or restrict the code. The House passed H.R. 1181 on July 14, 2026 to preempt both sides, but the Senate has not acted.
WooCommerce 11.2.0, released October 7, 2026, fixes CVE-2026-106608, which let shop managers take over multi-role accounts including some administrators, and adds four other security changes. 11.2.1 followed on October 9 with checkout fixes.
DEA's final rule creating a special registration for telemedicine has been under OMB review since August 25, 2026, with a November target and no public text, while the temporary flexibilities that let practitioners prescribe Schedule II through V drugs to never-seen patients expire at the end of December 31.
DEA filed a notice on October 9 that would schedule 7-OH and mitragynine pseudoindoxyl above 1 milligram per gram or a set ratio to mitragynine, replacing its July 0.050 percent proposal, while MGM-15 and MGM-16 stay in Schedule I and Tennessee, Massachusetts, Rhode Island, and Pennsylvania draw different state lines for kratom sellers.
Stripe, Checkout.com, and Worldpay documentation puts Mastercard's requirement that recurring and other merchant-initiated charges carry the original Transaction Link Identifier on October 23, 2026. The December 1, 2026 and January 31, 2027 dates now circulating match Worldpay's schedule for lifecycle linking, and Authorize.Net and NMI have not published TLID guidance.
