WP Manifestindependent plugin directory
manifest / ecommerce / hdwebmobile-formula-pricing

HDWebmobile Formula Pricing

WooCommerce plugin: safe formula-based product pricing, closing CVE-2026-4001's eval()-based RCE

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-formula-pricing · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-formula-pricing/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-formula-pricing ↗

Price a product from customer-entered numbers using a formula -- evaluated safely, never with PHP's eval().

Description

HDWebmobile Formula Pricing lets customers enter measurements or quantities on the product page, and prices the product live from a formula you write using those field names (e.g. 10 + width * height * 0.05 for a custom-cut material priced by area). This is a common real need for stores selling custom-sized fabric, framed prints, engraved items, or anything priced by dimension or quantity, not just a flat number.

Why this plugin exists

A competing "Custom Product Addons Pro" plugin implemented formula-based pricing by passing the merchant's formula text straight into PHP's eval() at calculation time (CVE-2026-4001) -- an unauthenticated remote code execution vulnerability. This plugin closes that entire vulnerability class by construction:

  • The formula is tokenized character-by-character into a strict set of allowed pieces: numbers, your own configured field names, and the four arithmetic operators plus parentheses. Anything else in the formula text -- any other letter sequence, any function-call-looking pattern, any special character -- causes the formula to be rejected outright when you save it.
  • The token stream is evaluated by a small hand-written arithmetic parser. There is no eval(), no create_function(), no dynamic function dispatch of any kind anywhere in this plugin -- the only operations that can ever run are addition, subtraction, multiplication, and division of plain numbers.
  • The customer-facing live price preview also never exposes your formula to the browser: it's computed by an AJAX call back to your own server, through the exact same safe evaluator used at checkout, so the formula text itself is never sent to a visitor's browser.
  • The real price used at checkout is always recomputed server-side from the product's own stored fields and formula -- never trusted from what the browser submitted.

Features

  • Add up to 6 numeric input fields per product (label, variable name, min/max bounds, default value)
  • Write a formula referencing those fields by name -- validated for safety the moment you save it
  • Live price preview on the product page as the customer types, computed server-side
  • Optional minimum/maximum price clamps, so no combination of inputs can produce an unreasonable price
  • Every field's min/max bounds are enforced again server-side at add-to-cart time, not just in the browser
  • Field values show on the cart, checkout, and order screens exactly as entered

Development

Standard WordPress plugin structure:

hdwebmobile-formula-pricing.php    Bootstrap
includes/class-hdfp-activator.php
includes/class-hdfp-admin.php
includes/class-hdfp-cart.php
includes/class-hdfp-core.php
includes/class-hdfp-formula-evaluator.php
includes/class-hdfp-frontend.php
includes/class-hdfp-hub.php
includes/class-hdfp-product.php

Part of the HDWebmobile suite of focused, single-purpose WooCommerce plugins.

License

GPLv2 or later. See LICENSE.