WP Manifestindependent plugin directory
manifest / ecommerce / customer-debt-manager

Customer Debt Manager WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

★ 0stars
12release downloads
≈10active sites
v1.0.2latest · 11mo ago

Install

Download customer-debt-manager.zip From the v1.0.2 release on GitHub, Nov 7, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/enishalimi/customer-debt-manager/releases/download/v1.0.2/customer-debt-manager.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Customer Debt Manager for WooCommerce

A WordPress plugin that allows customers to order on debt/credit and provides comprehensive debt tracking for both administrators and customers. Fully integrated with WooCommerce and compatible with High-Performance Order Storage (HPOS).

Features

For Customers:

  • Cash on Delivery (COD) Debt Creation: Automatically creates debt records for COD orders
  • WooCommerce My Account Integration: View debt status within the familiar My Account area
  • Order Management: View all orders with debt status and payment history
  • Debt Details: Modal popups with detailed debt and payment information
  • Order Navigation: Direct links to view order details when permitted

For Administrators:

  • Professional Admin Interface: WordPress-standard table with comprehensive debt management
  • Search & Filter: Find debts by customer name, email, order ID, or status
  • Sorting: Sort by any column (customer, order ID, amount, status, dates)
  • Payment Processing: AJAX-powered payment recording with instant updates
  • Customer Management: View and manage all customer debts from one interface
  • Export & Reporting: Easy overview of outstanding debts and payments

Technical Features:

  • HPOS Compatibility: Full support for WooCommerce High-Performance Order Storage
  • Automatic COD Processing: Seamless integration with WooCommerce order processing
  • Secure Access: Proper user authentication and permission checking
  • Clean Database Design: Optimized tables with proper relationships
  • AJAX Integration: Smooth user experience without page reloads
  • Responsive Design: Works on desktop and mobile devices

Installation

  1. Upload the Plugin:

    • Upload the customer-debt-manager folder to /wp-content/plugins/
    • Or install via WordPress admin: Plugins > Add New > Upload Plugin
  2. Activate the Plugin:

    • Go to WordPress admin > Plugins
    • Find "Customer Debt Manager" and click "Activate"
  3. Requirements Check:

    • The plugin will automatically check for WooCommerce
    • If WooCommerce is not active, activation will fail with a helpful message
  4. Automatic Setup:

    • Database tables are created automatically on activation
    • WooCommerce My Account integration is set up automatically
    • No additional configuration needed

Usage

For Customers:

  1. Place COD Orders: Any Cash on Delivery order automatically creates a debt record
  2. View Debt Status: Go to WooCommerce My Account > My Debt to see all orders and debt status
  3. Check Details: Click "Debt Details" button for payment history and information
  4. View Orders: Click "View Order" to see full order details (when permitted)

For Administrators:

  1. Access Admin Panel: Go to WordPress admin > Customer Debt Manager
  2. Search Debts: Use the search box to find specific customers or orders
  3. Filter by Status: Use status dropdown to filter pending/paid debts
  4. Record Payments: Click "Record Payment" to log customer payments
  5. Sort Data: Click column headers to sort by any field

Database Structure

The plugin creates two custom tables:

wp_customer_debts

  • Stores main debt records linked to orders
  • Tracks amounts, status, and dates
  • Links to WooCommerce customers and orders

wp_customer_debt_payments

  • Stores payment history for each debt
  • Tracks payment amounts, dates, and notes
  • Linked to debt records for complete audit trail

Compatibility

  • WordPress: 5.0+ (tested up to 6.3)
  • WooCommerce: 4.0+ (tested up to 8.0)
  • PHP: 7.4+ recommended
  • HPOS: Full compatibility with High-Performance Order Storage
  • Multisite: Compatible (not extensively tested)

Support

For support, feature requests, or bug reports, please contact the plugin developer.

Changelog

Version 1.0.0

  • Initial release
  • Full WooCommerce integration
  • HPOS compatibility
  • Admin and customer interfaces
  • Automatic COD debt creation
  • Search, filter, and sort functionality
  • AJAX payment processing
  • Responsive design

License

This plugin is licensed under the GPL v2 or later.


Note: This plugin requires WooCommerce to function. Make sure WooCommerce is installed and activated before installing this plugin.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.2 latest
Nov 7, 2025 11mo ago
customer-debt-manager.zip
3
Oct 6, 2025 1 year ago
customer-debt-manager.zip
9

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Customer Debt Manager 1.0.2 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
1.0.2
Findings
3
Worst severity
high
Content hash
3f0d7f1125c28c370bb52703…

Findings

  • high Missing capability check on cdm_add_payment AJAX allows debt ledger tampering

    missing_capability

    ajax_add_payment verifies only the cdm_add_payment nonce and then calls add_payment_simple to record a payment and reduce remaining debt. There is no current_user_can('manage_woocommerce') (or equivalent). Any authenticated user who can supply a valid nonce for that action can mark arbitrary debts as paid, enabling financial fraud against the merchant.

    includes/class-cdm-admin.php:1893-1932

    Recommendation

    Require current_user_can('manage_woocommerce') (same as the admin menu) immediately after the nonce check before mutating debt records.

  • medium Missing capability checks on debt detail AJAX disclose other customers' financial data

    missing_capability

    ajax_get_debt_details, ajax_get_debt_payments, and ajax_get_customer_debt_details only verify nonces. They return debt amounts, payment history, and (for customer details) email/display name for any customer_id/debt_id. Unlike ajax_get_customer_debt_summary, they do not call current_user_can('manage_woocommerce').

    includes/class-cdm-admin.php:1826-1960,2120-2240

    Recommendation

    Add current_user_can('manage_woocommerce') to all admin debt AJAX readers, matching ajax_get_customer_debt_summary.

  • low Unnecessary nopriv registration for frontend debt details AJAX

    unnecessary_attack_surface

    wp_ajax_nopriv_cdm_get_debt_details_frontend is registered but the handler immediately rejects unauthenticated users. This widens the attack surface without providing functionality.

    includes/class-cdm-frontend.php:27-28,590-594

    Recommendation

    Remove the nopriv action registration.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.