WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/lnbits/wp-donate-lnbits/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

This Wordpress plugin gives you the possiblity to accept Bitcoin lightning donations on your Wordpress site. For payments the plugin relies on a LNbits instance with plugin Satspay installed. Currently only Lightning payments are implemented since those are best suitable for value4value projects. You can see a live demo on the Dutch Bitcoin news site Bitcoin Focus

Admin settings

After installing the plugin you can set the following settings:

  • API Endpoint
  • API Key
  • Lightning Wallet
  • After payment create donation post
  • Currency Options

API Endpoint, API Key, Lightning Wallet

These settings you can take from your LNbits instance. API Endpoint is the url of your LNbits instance, without a / at the end. The API key and Lightning Wallet you find in the GUI of LNbits. Take it from the appropriate wallet.

After payment create donation post

When enabled, for every donation a post with donation title and message is created. The post is a custom post type: donation.

Currency Options

Give one (or more, seperated by a comma) currencies to be supported. Current options: SAT, EUR, USD, GBP. When SAT no conversion is done, For other options a conversion is done, before creating the payment.

Shortcode donation form

To show the donation form on a page or post you must include the following shortcode: [wp-donate-lnbits-form] into the page/post.

Shortcode to show donations

To show donations on a page or post you must include the following shortcode: [wp-donate-lnbits-donations] into the page/post. Using this makes only sense when the option 'After payment create donation post' is enabled.

Support

This plugin is initially created for clients of Lightning Checkout, but open sourced because of the general purpose of this plugin. If you have improvements please create an issue, or even better create a PR.

Releases

2 releases.

Tag
Published
0.2 latest
Dec 20, 2024 1 year ago
0.1
Apr 10, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

WP Donate LNbits 0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.2
Findings
1
Worst severity
high
Content hash
657758069bf912f28947317a…

Findings

  • high Public LNbits webhook lacks authenticity check before publishing donations

    missing_auth

    register_rest_route webhook uses permission_callback __return_true. handle_webhook parses JSON and publish_donation() flips matching draft donation posts to publish based solely on payment_hash presence, with no webhook secret/HMAC validation against LNbits.

    includes/webhook.php:4-50

    Recommendation

    Verify LNbits webhook signature/secret; confirm payment status via authenticated API call to LNbits before publishing.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.