WP Manifestindependent plugin directory
manifest / ecommerce / paytodaywooreleases

PayToday Payment Gateway for WooCommerce WP RegistryMedium-severity findings · 1 findingOpen the reportB GitLab

Releases repo for the PayToday Woocommerce payment gateway plugin for WordPress.

by PayToday · gitlab.com/josiahbanda/paytodaywooreleases

★ 0stars
v1.1.3latest · 7mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitLab with WP-CLI:

wp plugin install https://gitlab.com/josiahbanda/paytodaywooreleases/-/archive/main/paytodaywooreleases-main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme gitlab.com/josiahbanda/paytodaywooreleases ↗
PayToday WooCommerce Plugin A secure and easy-to-use payment gateway plugin that integrates PayToday payments with WooCommerce stores. Features - Seamless Integration: Easy integration with WooCommerce checkout process - Secure Payments: Process payments securely through PayToday's payment gateway - Sandbox Mode: Test payments in sandbox environment before going live - Order Management: Automatic order status updates based on payment results - Custom Return URLs: Configurable return URLs for successful payments - WordPress Admin Integration: Full integration with WordPress admin dashboard Requirements - WordPress: 5.0 or higher - WooCommerce: 3.0 or higher - PHP: 7.0 or higher - PayToday Account: Active PayToday merchant account with API credentials Installation Method 1: WordPress Admin Dashboard 1. Download the latest release from the Releases page 2. Log in to your WordPress admin dashboard 3. Navigate to Plugins Add New Upload Plugin 4. Choose the downloaded zip file and click Install Now 5. Activate the plugin after installation Method 2: Manual Installation 1. Download and extract the plugin files 2. Upload the paytodaywoo folder to /wp-content/plugins/ 3. Activat

Releases

4 releases.

Tag
Published
v1.1.3 latest
Mar 2, 2026 7mo ago
v1.1.2
Feb 3, 2026 8mo ago
v1.1.1
Sep 17, 2025 1 year ago
plugin-update
Sep 17, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

GitLab does not publish per-asset download counts, so this plugin ranks on stars and activity only.

B grade

Security

PayToday Payment Gateway for WooCommerce 1.1.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.3
Findings
1
Worst severity
medium
Content hash
69d73557828e5e1a50f41d65…

Findings

  • medium Unauthenticated order status AJAX is IDOR (nonce-only)

    missing_auth

    paytoday_ajax_check_status is on wp_ajax_nopriv_paytoday_check_status. Auth is only wp_verify_nonce('paytoday_status_check'); that nonce is printed into the checkout/payment page HTML for guests. Caller supplies arbitrary order_id. Handler reads that order's PayToday tokens, queries the gateway, and on completed/success calls $order->payment_complete(). Concrete consequence: unauth enumeration of payment completion state for other orders and ability to trigger payment_complete for any order whose gateway status is already completed (cross-order IDOR).

    paytoday-woocommerce.php:1203-1260

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →