WP Manifestindependent plugin directory
manifest / ecommerce / export-woo-customer-data

Export Woo Customer Data WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Export WooCommerce customer data to CSV with customizable fields via dashboard widget.

★ 0stars
9release downloads
v1.1.2latest · 8mo ago

Install

Download export-woo-customer-data.zip From the v1.1.2 release on GitHub, Jan 30, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/headwalluk/export-woo-customer-data/releases/download/v1.1.2/export-woo-customer-data.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Version: 1.1.2
Requires: WordPress 6.0+, PHP 8.0+, WooCommerce 9.0+
License: GPLv2 or later

A lightweight WordPress/WooCommerce utility plugin to export customer data via CSV with customizable fields.


Features

  • ✅ Dashboard Widget - One-click export buttons on WordPress dashboard
  • ✅ Two Export Modes - Export all users or WooCommerce customers only
  • ✅ Pretty URLs - Clean download links like /wp-admin/exportwcd-reports/customers-only.csv
  • ✅ HPOS Compatible - Works with WooCommerce High-Performance Order Storage
  • ✅ Customizable Fields - Extensible via filter hooks
  • ✅ Excel-Friendly - UTF-8 BOM for proper character encoding
  • ✅ Secure - Admin-only access with capability checks

Installation

Via WordPress Admin

  1. Upload the plugin folder to /wp-content/plugins/
  2. Activate via Plugins → Installed Plugins
  3. Navigate to Dashboard to see the widget

Via WP-CLI

wp plugin activate export-woo-customer-data

Usage

Basic Export

  1. Go to the WordPress Dashboard
  2. Find the Export Customer Data widget
  3. Click one of two buttons:
    • Export All Users - All WordPress user accounts
    • Export Customers Only - Users who have placed orders (requires WooCommerce)
  4. CSV file downloads automatically

Default Export Fields

Field Source
User ID wp_users.ID
First Name wp_usermeta.first_name
Last Name wp_usermeta.last_name
Email wp_users.user_email
Billing Phone wp_usermeta.billing_phone
Shipping Phone wp_usermeta.shipping_phone

Developer Documentation

Customizing Export Fields

Use the export_woo_customer_data_fields filter to modify field mapping:

add_filter( 'export_woo_customer_data_fields', function( $fields ) {
    // Add user login
    $fields['username'] = array(
        'table'  => 'users',
        'column' => 'user_login',
    );

    // Add custom user meta
    $fields['phone'] = array(
        'table'    => 'usermeta',
        'meta_key' => 'phone',
    );

    // Remove a field
    unset( $fields['shipping_phone'] );

    return $fields;
} );

Field Configuration Structure

Each field requires:

For wp_users table:

array(
    'table'  => 'users',
    'column' => 'column_name',  // e.g., 'user_email', 'user_login', 'ID'
)

For wp_usermeta table:

array(
    'table'    => 'usermeta',
    'meta_key' => 'meta_key_name',  // e.g., 'first_name', 'billing_phone'
)

Pretty URL Structure

Export URLs follow this pattern:

  • All Users: /wp-admin/exportwcd-reports/all-users.csv
  • Customers Only: /wp-admin/exportwcd-reports/customers-only.csv

These URLs:

  • Require manage_options capability
  • Generate CSV on-the-fly (no file storage)
  • Stream directly to browser
  • Trigger download automatically

Security

  • Capability Check: Only users with manage_options (admins) can export
  • HPOS Compatible: Uses WooCommerce CRUD methods for order data
  • No File Storage: CSV generated in-memory and streamed
  • Input Validation: Report types validated against whitelist
  • WordPress Standards: Follows WordPress Security Best Practices

HPOS Compatibility

The plugin automatically detects and supports WooCommerce High-Performance Order Storage (HPOS):

  • HPOS Enabled: Queries wp_wc_orders table
  • Legacy Mode: Queries wp_postmeta for _customer_user

Compatibility is declared via FeaturesUtil::declare_compatibility().


File Structure

export-woo-customer-data/
├── export-woo-customer-data.php  # Main plugin file
├── constants.php                 # Plugin constants
├── functions-private.php         # Helper functions
├── includes/
│   ├── class-plugin.php          # Main plugin class
│   ├── class-admin-hooks.php     # Dashboard widget
│   └── class-csv-exporter.php    # CSV generation logic
├── dev-notes/                    # Development documentation
├── README.md                     # This file
├── readme.txt                    # WordPress.org readme
└── CHANGELOG.md                  # Version history

Requirements

  • WordPress: 6.0 or higher
  • PHP: 8.0 or higher
  • WooCommerce: 7.0+ (optional, required for "Customers Only" export)

Privacy & Compliance

This plugin exports sensitive user data including:

  • Email addresses
  • Phone numbers
  • User IDs

Important: Ensure you have:

  • User consent for data export (GDPR compliance)
  • Appropriate data handling policies
  • Secure download/storage of exported files

Changelog

See CHANGELOG.md for version history.


Support

For issues, questions, or feature requests:


License

This plugin is licensed under GPLv2 or later.

Copyright (C) 2026 Headwall Tech

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

Credits

Developed by: Headwall Tech
Version: 1.0.0
Release Date: January 29, 2026

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.2 latest
Jan 30, 2026 8mo ago
export-woo-customer-data.zip +1 asset
7
export-woo-customer-data.zip7
export-woo-customer-data-1.1.2.zip0
Jan 29, 2026 8mo ago
export-woo-customer-data.zip +1 asset
0
export-woo-customer-data.zip0
export-woo-customer-data-1.1.1.zip0
Jan 29, 2026 8mo ago
export-woo-customer-data.zip +1 asset
2
export-woo-customer-data.zip2
export-woo-customer-data-1.1.0.zip0
B grade

Security

Export Woo Customer Data 1.1.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.2
Findings
1
Worst severity
medium
Content hash
e46e6f97e7ffc7dc62730ba1…

Findings

  • medium PII CSV export is a CSRF-able GET with unused nonce constant

    csrf

    template_redirect handle_export_request() exports all users or WooCommerce customers when query var exportwcd_report is all-users or customers-only. The dashboard widget links to home_url('/wp-admin/exportwcd-reports/all-users.csv') with no nonce. constants.php defines NONCE_EXPORT_ACTION = 'export_woo_customer_data_export' but nothing calls wp_verify_nonce/check_admin_referer. WordPress auth cookies are SameSite=Lax, so a top-level GET from a malicious page will run the export in the administrator's browser.

    includes/class-plugin.php:166-199

    Recommendation

    Require POST plus check_admin_referer(NONCE_EXPORT_ACTION) (already defined) before generating the CSV; do not export on a guessable GET.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.