WP Manifestindependent plugin directory
manifest / ecommerce / hdwebmobile-order-export

HDWebmobile Order Export

Export WooCommerce orders to CSV, filtered by date range and status. Every query goes through wc_get_orders() (never raw SQL) and CSV output extends WooCommerce's own WC_CSV_Exporter, so formula-injection-safe escaping comes from WooCommerce core itself.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-order-export · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-order-export/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-order-export ↗

Export WooCommerce orders to CSV, filtered by date range and status -- built entirely on WooCommerce's own query and export classes.

Description

HDWebmobile Order Export adds a simple "Order Export" screen where you pick a date range and one or more order statuses, then download a CSV with order ID, customer details, addresses, items, totals, and coupon codes -- ready for accounting, shipping, or any spreadsheet workflow.

Two real vulnerability classes were researched in this exact plugin category, both found in a widely-installed competing order-export plugin: a SQL injection caused by a sort-direction parameter concatenated straight into a raw query, and CSV/formula injection, where an exported cell value starting with =, +, -, or @ executes as a formula when the file is opened in Excel or Sheets. This plugin closes both by construction rather than by bolted-on sanitization: every order is fetched through WooCommerce's own wc_get_orders() (never a raw SQL string), and every CSV cell is written through WooCommerce core's own WC_CSV_Exporter base class, which already implements the OWASP-recommended formula-injection escaping -- this plugin reuses WooCommerce's own trusted, already-audited code instead of writing a new CSV writer from scratch.

Features

  • Filter by date range and/or one or more order statuses before exporting
  • One-click CSV download -- no file is ever written to the server, the export streams directly to your browser
  • Every order fetched through WooCommerce's own order-query API -- no raw SQL anywhere in this plugin
  • Every exported cell escaped through WooCommerce core's own CSV exporter class -- closes the exact formula-injection class found in a competing plugin
  • Order status filter is validated against WooCommerce's own registered statuses -- closes the exact unescaped-parameter class behind a SQL-injection CVE found in a competing plugin
  • Zero configuration -- no settings to save, nothing persisted in the database

Development

Standard WordPress plugin structure:

hdwebmobile-order-export.php    Bootstrap
includes/class-hdoe-activator.php
includes/class-hdoe-admin.php
includes/class-hdoe-core.php
includes/class-hdoe-exporter.php
includes/class-hdoe-hub.php

Part of the HDWebmobile suite of focused, single-purpose WooCommerce plugins.

License

GPLv2 or later. See LICENSE.