WP Manifestindependent plugin directory

Install

Download bocs-wordpress.zip From the v0.0.154 release on GitHub, May 13, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bocs-io/bocs-wordpress-plugin/releases/download/v0.0.154/bocs-wordpress.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

v0.0.97 01/09/2025

  • Update version for the widget in whatever environment
  • Fixed on the discount

v0.0.96 01/09/2025

  • Update version for the widget if in developer mode

v0.0.95 01/08/2025

  • Remove stripe keys from the settings page
  • Changes on the developer mode

v0.0.94 01/07/2025

  • Fixes on the creation of the subscription after the payment

v0.0.93 01/07/2025

  • Fix on the URL for the cart page redirect

v0.0.92 01/06/2025

  • Closing parenthesis of a multi-line function call must be on a line by itself

v0.0.91 01/06/2025

  • Added the wp's js documentation

v0.0.90 01/06/2025

  • Added the bocsCartObject's js documentation to the bocs-cart.js

v0.0.89 01/06/2025

  • pull request fix for the add-to-cart.js
  • add to cart fix

v0.0.88 12/10/2024

  • Undefined array key "bocs-view-subscription" fix

v0.0.87 12/03/2024

  • Updated the widget javascript file

v0.0.86 12/02/2024

  • Fixes return output on the other API endpoints

v0.0.85 11/30/2024

  • Fixes on the API endpoints related to the contacts

v0.0.84 11/29/2024

  • Fixes on the API endpoints (e.g. from data to data->data)

v0.0.83 11/26/2024

  • Added collection and widget list on the widget editor
  • Improved documentation on the widget editor
  • refactored the widget editor javascript
  • added the updater for the plugin for pre-release and release

v0.0.82 11/26/2024

  • Added the developer mode switch for the widget URL

v0.0.81 11/19/2024

  • Added the stripe keys settings

v0.0.80 11/18/2024

  • Add the updating of the next payment date on the subscription page

v0.0.79 11/15/2024

  • Fix the issue on the duplicate products when the product is added to the cart
  • Fix the issue Cancel, Pause, Renew subscription buttons on the subscription page

v0.0.78 11/11/2024

  • Added (alpha) to the plugin name

v0.0.77 11/11/2024

  • Fix on the developer mode switch as the frontend was not updating

v0.0.76 11/06/2024

  • Bug fixes and added developer mode

v0.0.75 11/06/2024

  • updated bocs widget javascript url's version

v0.0.74 11/05/2024

  • updated to production link for the api

v0.0.73 10/16/2024

  • My profile subscriptions list fix

v0.0.72 10/10/2024

  • Hide old bocs page
  • empty bocs headers error traps

v0.0.71 10/08/2024

  • Fixed on bocs list table not showing data

v0.0.70 10/04/2024

  • applied fixes on adding subscription and order on the bocs end

v0.0.69 10/03/2024

  • updates on the add-to-cart.js
  • added getting of the bocs id

v0.0.68 08/27/2024

  • updated bocs widget javascript file
  • added the widget

v0.0.67 06/24/2024

  • added the bocs subscription related for the cart and checkout page

v0.0.66 06/18/2024

  • Added related orders
  • Added email triggers for the renewal orders
  • Added the custom woocommerce rest api for email

v0.0.65 06/11/2024

  • default ticked for 'Save payment information to my account for future purchases'
  • add the subscriptions totals after the buttons

v0.0.64 06/10/2024

  • Add renew, cancel subscription

v0.0.63 05/30/2024

  • Fix on the add subscription to bocs after the payment
  • Listing of the subscriptions fix (first page)

v0.0.62 05/30/2024

  • Fix on the add subscription to bocs after the payment
  • Listing of the subscriptions fix (first page)

v0.0.61 05/28/2024

  • Removed the product type of bocs type

v0.0.60 05/24/2024

  • Ajax object name fix conflict with other plugins

v0.0.57 05/14/2024

  • Fix on the auto adding of the bocs keys to woocommerce site

v0.0.56 05/08/2024

  • Check if WooCommerce is enabled before installing
  • Add Status settings like of the WooCommerce

v0.0.55 05/02/2024

  • Authorization Settings fix

v0.0.54 04/22/2024

  • Onchange fix on the selections for the collections and bocs

v0.0.53 04/18/2024

  • API related fixes for creating subscription

v0.0.52 04/17/2024

  • fix for the admin.js related to the API

v0.0.50 04/15/2024

  • updated the bocsId to id
  • updated the productId to id

v0.0.49 04/15/2024

  • updated the bocsId to id
  • updated the collectionId to id

v0.0.48 10/26/2023

  • added the method for adding and showing of the Bocs' product logs
  • added the admin sidebar for the product's bocs logs

v0.0.47 10/16/2023

  • added the auto add of the collections and widgets when the apps' end was updated

v0.0.46 10/06/2023

  • get the list of the collections and widgets every hour
  • loads the list of the collections and widgets directly

v0.0.45 10/03/2023

  • readme changes

v0.0.44 10/03/2023

  • correction on the edit page

v0.0.43 10/03/2023

  • Added icon on the description
  • Edit Page, showing the selected/saved

v0.0.42 09/29/2023

  • New UI added on Gutenburg Editor

v0.0.41 09/21/2023

  • Fix error when both Gutenburg and sidebar is loading

v0.0.40 09/18/2023

  • Fix error when creating a customer via API

v0.0.38 09/15/2023

  • Redirects to the checkout page

v0.0.37 09/14/2023

  • Added support for editors using ACF

v0.0.36 09/13/2023

  • Added the Fixed type

v0.0.35 08/16/2023

  • Added filter on the admin users list for options bocs or wordpress or both

v0.0.34 08/11/2023

  • Added Source (Wordpress or Bocs) column on Admin Users List

v0.0.33 08/04/2023

  • Moved the sync logs and sync modules under settings as tabs

v0.0.32 08/01/2023

  • Fixes on the sync end

v0.0.31 07/31/2023

  • create/register new user log/sync

v0.0.30 07/30/2023

  • log's context update to json encoded array
  • added details on the table display

v0.0.29 07/27/2023

  • Endpoint ID fix
  • Added logs on the syncs
  • Added module and id on logs

v0.0.28 07/26/2023

  • Updated the endpoint for the sync
  • Removed the logs related code due to errors

v0.0.27 07/24/2023

  • moved the position of the menu
  • added sample error log menu and content

v0.0.26 07/24/2023

  • Fix when the bocs' contact id is outdated or not on the same Bocs Account

v0.0.25 07/20/2023

  • When user his own profile - trigger sync

v0.0.24 07/18/2023

  • Added synced when a user is edited

v0.0.23 07/13/2023

  • saving on the bocs widget editor fix

v0.0.22 07/12/2023

  • added radio input on the bocs widget editor
  • remove highlight to non-active option

v0.0.21 07/11/2023

  • added auto add bocs keys needed

v0.0.20 07/07/2023

  • added the working plugin updater

v0.0.19 07/06/2023

  • fix widget for the collections list
  • added wordpress updater

v0.0.18 07/03/2023

  • added collections list

v0.0.17 06/29/2023

  • added the list of subscriptions and showing under the menu
  • added the discount upon checkout

v0.0.16 06/29/2023

  • add subscription to bocs app
  • add new subscription to wordpress site - tables only

v0.0.15 06/28/2023

  • fixes on the cart checkout
  • added logo on the menu

v0.0.14 06/27/2023

  • added creation of the bocs and products if not synced on checkout
  • if the order is paid or processing, it will create an order and subscription on bocs end
  • fix not showing list of bocs

Releases

Newest 25 of 60 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.0.154 latest
May 13, 2025 1 year ago
bocs-wordpress.zip
8
May 12, 2025 1 year ago
bocs-wordpress.zip
4
May 8, 2025 1 year ago
bocs-wordpress.zip
3
May 7, 2025 1 year ago
bocs-wordpress.zip
2
May 6, 2025 1 year ago
bocs-wordpress.zip
5
May 5, 2025 1 year ago
bocs-wordpress.zip
3
May 2, 2025 1 year ago
bocs-wordpress.zip
1
May 2, 2025 1 year ago
bocs-wordpress.zip
3
Apr 30, 2025 1 year ago
bocs-wordpress.zip
2
Apr 29, 2025 1 year ago
bocs-wordpress.zip
3
Apr 29, 2025 1 year ago
bocs-wordpress.zip
3
Apr 28, 2025 1 year ago
bocs-wordpress.zip
2
Apr 25, 2025 1 year ago
bocs-wordpress.zip
3
Apr 25, 2025 1 year ago
bocs-wordpress.zip
6
Apr 24, 2025 1 year ago
bocs-wordpress.zip
2
Apr 23, 2025 1 year ago
bocs-wordpress.zip
3
Apr 21, 2025 1 year ago
bocs-wordpress.zip
2
Apr 10, 2025 1 year ago
bocs-wordpress.zip
2
Apr 9, 2025 1 year ago
bocs-wordpress.zip
5
Apr 8, 2025 1 year ago
bocs-wordpress.zip
0
Apr 7, 2025 1 year ago
bocs-wordpress.zip
5
Apr 4, 2025 1 year ago
bocs-wordpress.zip
2
Apr 3, 2025 1 year ago
bocs-wordpress.zip
2
Apr 1, 2025 1 year ago
bocs-wordpress.zip
2
Mar 31, 2025 1 year ago
bocs-wordpress.zip
4
All releases on GitHub →
D+ grade

Security

Bocs (alpha) 0.0.154 · audited by WP Registry

High-severity findings.

3 high 1 medium
Audited release
0.0.154
Findings
4
Worst severity
high
Content hash
3e2ae7c3ed0d4a7fa672b6d0…

Findings

  • high Unauthenticated AJAX creates and updates published WooCommerce products

    missing_auth

    wp_ajax_nopriv_create_product and wp_ajax_nopriv_update_product map to Admin::create_product_ajax_callback / update_product_ajax_callback. Both only verify nonces (ajax-nonce and ajax-update-product-nonce) that Admin::enqueue_scripts localizes on every frontend page as bocsAjaxObject.nonce and update_product_nonce. create_product_ajax_callback wp_insert_post()s a published product with unsanitized title/price/sku and attacker-controlled bocs_* meta. update_product_ajax_callback writes bocs_product_id onto any product ID. No capability check. Observable consequence: unauthenticated catalog spam and product-meta tamper; titles flow into shop/cart templates.

    includes/Admin.php:1127-1194

    Recommendation

    Remove nopriv registrations. Require manage_woocommerce (or a signed Bocs-to-WP webhook). Sanitize/kses all product fields. Do not localize product-write nonces on public pages.

  • high No object-level authorization on subscription view, pause, update, switch, or payment-method change

    missing_capability

    My Account and AJAX handlers accept a client-supplied subscription_id and call the Bocs API with the store's credentials. None verify the subscription's customer.externalSourceId (or billing email) matches get_current_user_id(). Bocs_Account::bocs_view_subscription_endpoint_content GETs /subscriptions/{id} and related orders for whoever is logged into WooCommerce My Account. BOCS_AJAX::pause_subscription PUTs /subscriptions/{id}/pause after a bocs-ajax-nonce (printed on my-account). handle_update_box, switch_bocs_subscription, ajax_update_subscription, ajax_update_subscription_products, and ajax_update_payment_method likewise PATCH any ID. wp_ajax_nopriv_* counterparts return must_login_first, so this is customer-vs-customer IDOR, not unauth. Observable consequence: customer A with a valid account nonce pauses, retargets payment, or reads billing/line items for customer B's subscription.

    includes/class-bocs-ajax.php:1105-1230

    Recommendation

    After nonce checks, load the subscription and require customer.externalSourceId === current user ID (or billing email match). Deny before any PATCH/PUT/GET with store credentials.

  • high Logged-in customers receive other users' Stripe payment tokens

    information_disclosure

    Bocs_Account::ajax_get_payment_methods (wp_ajax_bocs_get_payment_methods, nonce bocs-ajax-nonce on My Account) queries woocommerce_payment_tokens for the current user, then hardcodes token_ids 47–52 and, if those rows exist for a different user_id, still appends them when gateway_id is stripe. ajax_get_missing_tokens does the same for IDs 47 and 48 and returns token (Stripe pm_/src_ ID), last4, expiry, and brand in the JSON response. The handler also wp_cache_flush()es. Observable consequence: any logged-in customer can obtain other customers' Stripe payment-method IDs (and, chained with the public Stripe secret-key route, charge those methods). This is leftover debug code, not a capability-gated admin tool.

    includes/Bocs_Account.php:887-913

    Recommendation

    Delete hardcoded token-ID lookups. Only return WC_Payment_Tokens::get_customer_tokens(get_current_user_id()). Remove wp_cache_flush() from AJAX.

  • medium Any logged-in user can write the store-wide bocs_product_mapping option

    missing_capability

    BOCS_AJAX::update_product_mappings is wp_ajax_ only (login required) and checks nonce bocs_update_mappings_nonce (localized on My Account edit-details). It explicitly allows any logged-in user, json_decodes POST mappings, and update_option('bocs_product_mapping', ...). That option maps Bocs product IDs to WooCommerce product IDs and is later read when resolving subscription line-item names/prices. Observable consequence: a Subscriber can re-point Bocs SKUs at different WooCommerce products, affecting subsequent box updates and displays. add/remove_product_mapping correctly require manage_options; this handler does not.

    includes/class-bocs-ajax.php:1547-1616

    Recommendation

    Require manage_woocommerce for mapping writes, or restrict updates to mappings for products in the current user's own subscription and never allow arbitrary ID pairs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.