WP Manifestindependent plugin directory
manifest / ecommerce / dish-dash

Dish Dash WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

DishDash is a smart ordering system that learns customer behavior and makes ordering faster, easier, and more personalized every time.

★ 0stars
86release downloads
v3.18.47latest · 18d ago

Install

Download dish-dash.zip From the v3.18.47 release on GitHub, Oct 5, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/frisoftltd/dish-dash/releases/download/v3.18.47/dish-dash.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

The smart restaurant ordering system that learns customer behavior — menus, cart, delivery, reservations, WhatsApp notifications, and AI analytics, built on WooCommerce.

Description

Dish Dash is a behavior-driven restaurant ordering and management system built on WordPress and WooCommerce. It is designed to reduce time-to-order, increase repeat orders, and personalize the ordering experience through AI — without relying on third-party delivery marketplaces.

Dish Dash is NOT a generic WooCommerce storefront. It is a fully custom ordering experience with its own frontend templates, mobile-first UI, and a behavior tracking engine that collects data for AI-powered personalization.

What makes Dish Dash different:

  • Commission-free — no 30% fees to Uber Eats or Glovo
  • Behavior-driven — every user action is tracked and used to improve future orders
  • AI-ready — collecting the data now so the AI layer can personalize later
  • Mobile-first — built for Africa where ordering happens on phones, not desktops
  • WhatsApp-native — order notifications and customer communication via WhatsApp

Core Features (Live):

  • Mobile 3-screen menu UI — category list → product list → single product
  • Desktop menu with category filter, live search, and deep links
  • Cart panel with floating button, live totals, and delivery progress nudge
  • Checkout with WhatsApp number as primary customer identity
  • Threshold-based delivery fee calculation (free delivery above configurable amount)
  • WhatsApp order notifications — admin receives full order, customer receives confirmation
  • Birthday collection flow — second WhatsApp message after first order only
  • Table reservations with WhatsApp notifications and admin management
  • Customer profiles — tier system (Regular, VIP, Champion, Diamond) based on lifetime spend
  • Behavior tracking engine — view_product, add_to_cart, search, cart_open, order, reservation_made, and more
  • Google Reviews integration with 12-hour caching
  • Email authentication with SMTP verification
  • Opening hours system with split sessions and closed-state UI

Coming in Future Phases:

  • Backend analytics dashboard — top products, peak hours, repeat customers, revenue trends
  • AI Rules Engine — behavior-based personalization and smart nudges
  • Loyalty & QR — points system and QR scan ordering
  • SaaS Platform — multi-tenant white-label for other restaurants

Installation

  1. Upload the dish-dash folder to /wp-content/plugins/
  2. Activate the plugin through the Plugins menu in WordPress
  3. Ensure WooCommerce is installed and active
  4. Go to Dish Dash → Settings to configure your restaurant details
  5. Add menu items as WooCommerce products with categories
  6. Add the shortcode [dd_menu] to your menu page

Frequently Asked Questions

Does this require WooCommerce?

Yes. WooCommerce handles products, cart sessions, and payment processing. Dish Dash sits on top of WooCommerce as an ordering layer.

What PHP version is required?

PHP 8.2 or higher is required.

Does this work with any WordPress theme?

Dish Dash ships with its own custom theme (dish-dash-theme) and its own frontend templates. It is designed to run as a standalone ordering site, not alongside a generic WordPress theme.

How does WhatsApp notification work?

Dish Dash uses WhatsApp wa.me links (Mode A). When an order is placed, the customer is shown a WhatsApp link pre-filled with their order confirmation. Admin receives a separate notification. WhatsApp Business API (Mode B) is planned for a future release.

Is customer data stored?

Yes. Customer records are stored in a custom database table using WhatsApp number as the primary identity. Order history, delivery address, birthday (if provided), and spend tier are tracked per customer.

Changelog

3.4.9

  • Pre-Phase 5 audit fixes: frontend asset gating, N+1 query eliminated in menu grid, cross-module DB violation resolved, dead tracking schemas removed

3.4.8

  • Phase 4 complete: reservations with WhatsApp notifications, deposit scaffolding, customer tier system, Google Reviews integration, auth module with email verification

3.2.12

  • Phase 2 complete: mobile 3-screen menu UI, desktop menu polish, deep links, behavior tracking validated, DD_API data layer live

3.1.17

  • Schema versioning, DD_API facade, event health check, 0% tracking failure rate

Upgrade Notice

3.4.9

Audit fix release. No database changes. Safe to update.

Releases

Newest 25 of 60 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v3.18.47 latest
Oct 5, 2026 18d ago
dish-dash.zip
3
Oct 5, 2026 18d ago
dish-dash.zip
0
Sep 2, 2026 1mo ago
dish-dash.zip
4
Sep 2, 2026 1mo ago
dish-dash.zip
1
Sep 1, 2026 1mo ago
dish-dash.zip
2
Aug 31, 2026 1mo ago
dish-dash.zip
2
Aug 31, 2026 1mo ago
dish-dash.zip
1
Aug 21, 2026 2mo ago
dish-dash.zip
2
Aug 19, 2026 2mo ago
dish-dash.zip
2
Aug 19, 2026 2mo ago
dish-dash.zip
0
Aug 19, 2026 2mo ago
dish-dash.zip
1
Aug 19, 2026 2mo ago
dish-dash.zip
1
Aug 19, 2026 2mo ago
dish-dash.zip
2
Aug 19, 2026 2mo ago
dish-dash.zip
1
Aug 19, 2026 2mo ago
dish-dash.zip
2
Aug 19, 2026 2mo ago
dish-dash.zip
1
Aug 19, 2026 2mo ago
dish-dash.zip
2
Aug 18, 2026 2mo ago
dish-dash.zip
1
Aug 13, 2026 2mo ago
dish-dash.zip
3
Aug 9, 2026 2mo ago
dish-dash.zip
2
Aug 9, 2026 2mo ago
dish-dash.zip
2
Aug 9, 2026 2mo ago
dish-dash.zip
1
Aug 8, 2026 2mo ago
dish-dash.zip
2
Aug 7, 2026 2mo ago
dish-dash.zip
3
Aug 7, 2026 2mo ago
dish-dash.zip
1
All releases on GitHub →
B- grade

Security

Dish Dash 3.18.47 · audited by WP Registry

Medium-severity findings.

3 medium
Audited release
3.18.47
Findings
3
Worst severity
medium
Content hash
7b7b2ee2b88684e3db32ee3f…

Findings

  • medium Any wp-admin user can confirm or cancel reservations

    missing_capability

    The Dish Dash top-level menu is registered with capability read, and admin.js localizes a dish_dash_admin nonce on every dish-dash admin screen. WooCommerce still blocks subscriber and customer from wp-admin, but contributor, author, editor, and shop_manager have edit_posts, so they can open the dashboard and receive a nonce valid for their user. dd_reservation_update_status is logged-in only and checks that nonce, then writes dishdash_reservations.status to pending, confirmed, cancelled, or no_show and fires dish_dash_reservation_status_changed. There is no current_user_can( 'dd_manage_reservations' ) check, unlike the bulk-action and mark-deposit-paid handlers in the same class. A shop manager or author can confirm or cancel any booking.

    modules/reservations/class-dd-reservations-module.php:457-483

    Recommendation

    Require current_user_can( 'dd_manage_reservations' ) in ajax_update_status before any write. Register the dashboard menu with a Dish Dash staff cap, not read, and do not print the dish_dash_admin nonce on screens those roles cannot use.

  • medium Dashboard shows other customers' orders to anyone who can open wp-admin

    information_disclosure

    admin/pages/dashboard.php returns only if the user lacks read, which is the same cap as the menu. The page then queries dishdash_orders and dishdash_reservations and prints recent orders (customer_name, total, status), the kitchen queue (customer name, order number, total), today's reservation names, average order value, and the revenue chart. The revenue KPI card is wrapped in dd_view_billing, but the chart, recent orders, and kitchen queue are not. Contributor, author, editor, and shop_manager can load admin.php?page=dish-dash and read that customer and revenue data. Subscriber and customer are still stopped by WooCommerce's prevent_admin_access.

    admin/pages/dashboard.php:10-10, 156-166, 381-415

    Recommendation

    Gate the dashboard callback and menu with dd_manage_orders (or a dedicated view cap), and do not render customer names or revenue unless that cap passes.

  • medium Restaurant Owner and Manager are full WordPress administrators

    insecure_config

    install.php register_roles() grants both dd_restaurant_owner and dd_restaurant_manager manage_options, manage_woocommerce, and every Dish Dash cap. migrate_roles_v2() removes and recreates those roles so existing installs pick the caps up. Admin menu items for settings and plugins are hidden in CSS and admin_menu callbacks, which does not remove the capability. The plugin's own dd_is_platform_admin() exists because current_user_can( 'manage_options' ) is true for these roles. A staff account created as Restaurant Manager can install plugins, edit users, and create administrators. That is full site takeover from a role the UI presents as operational staff.

    install.php:579-620

    Recommendation

    Remove manage_options from both restaurant roles. Grant only the dd_* caps they need, and allow wp-admin via view_admin_dashboard or the existing staff_allow_admin_access filter. Keep using dd_is_platform_admin() for billing and plugin-update actions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.