WP Manifestindependent plugin directory
manifest / ecommerce / kra-etims-woocommerce

KRA eTims Integration WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A WordPress plugin that integrates WooCommerce Online Sales with the Kenya Revenue Authority (KRA) Electronic Tax Register (ETR) System.

★ 9stars
11release downloads
v1.0.1latest · 1 year ago

Install

Download kra-etims-integration.zip From the v1.0.1 release on GitHub, Apr 12, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/matatashadrack/kra-etims-woocommerce/releases/download/v1.0.1/kra-etims-integration.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

KRA ETR Integration for Wordpress/Woocommerce

A WordPress plugin that integrates WooCommerce with the Kenya Revenue Authority (KRA) Electronic Tax Register (ETR) System.

Description

This plugin allows WooCommerce store owners to automatically submit sales transactions to the KRA ETR system when orders are completed and generate ETR-compliant receipts. It provides a seamless integration between your WordPress WooCommerce store and the KRA ETR API, ensuring compliance with KRA's electronic tax invoice requirements for online sales.

KRA ETR Configurator

Screenshot: The KRA ETR visual configurator for WordPress WooCommerce

Features

  • Automatic submission of sales transactions to KRA ETR when orders are completed
  • Generation of ETR-compliant receipts for online sales on WordPress WooCommerce websites
  • Manual submission of orders from the WooCommerce order edit screen
  • Visual configurator with intuitive environment switching between development and production
  • Configurable settings for API credentials, TIN, Branch ID, and more
  • Detailed logging for debugging purposes
  • Test connection functionality to verify API credentials

Installation

  1. Download the plugin files and upload them to your /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Go to the 'KRA ETR' menu in your WordPress admin to configure the plugin settings

Configuration

  1. Navigate to the 'KRA ETR' menu in your WordPress admin
  2. Enter your KRA ETR API credentials:
    • Username
    • Password
    • Taxpayer Identification Number (TIN)- KRA PIN number in other words
    • Branch ID (default is "00" for main branch)
  3. Select the environment (Development/Sandbox or Production) using the visual environment selector
  4. Configure general settings:
    • Auto Submit: Enable/disable automatic submission of orders when they are completed
    • Debug Mode: Enable/disable detailed logging for debugging purposes
  5. Click "Save Changes" to save your settings
  6. Use the "Test Connection" button to verify your API credentials

Usage

Automatic Submission

When an order is marked as "Completed" in WooCommerce, the plugin will automatically submit the sales transaction to KRA ETR if the "Auto Submit" option is enabled. This works with both manual order completion and automatic completion through payment gateways like PayPal or M-Pesa.

Manual Submission

You can manually submit an order to KRA ETR from the WooCommerce order edit screen:

  1. Go to WooCommerce > Orders
  2. Edit an order
  3. In the "KRA ETR Integration" meta box, click the "Submit to KRA ETR" button

Alternatively, you can use the order actions dropdown:

  1. Go to WooCommerce > Orders
  2. Click the "Actions" button for an order
  3. Select "Submit to KRA ETR" from the dropdown

Requirements

  • WordPress 5.6 or higher
  • WooCommerce 5.0 or higher
  • PHP 7.4 or higher

ETR-Compliant Receipts

The plugin automatically calculates VAT at 16% of the item price as required by KRA regulations. For example, if an item costs 100 shillings, the tax amount will be 16 shillings. This ensures that all receipts generated are compliant with KRA ETR requirements for online sales.

Support

For support, please contact the plugin author:

  • Shadrack Matata
  • Email: kisamba.debug@gmail.com
  • Tel: +254722854082 / +254733854082

License

This plugin is licensed under the ISC License.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.1 latest
Apr 12, 2025 1 year ago
kra-etims-integration.zip
9
Apr 12, 2025 1 year ago
kra-etims-woocommerce.zip
2
D+ grade

Security

KRA eTims Integration 1.0.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.0
Findings
2
Worst severity
high
Content hash
69d8d0a98275215db1de38b5…

Findings

  • high Order eTims submit AJAX missing capability check

    missing_capability

    ajax_submit_order only verifies kra_etims_submit_order nonce then processes any order_id. No current_user_can('edit_shop_orders') / manage_woocommerce. Any authenticated user who obtains a valid nonce (or an admin who is CSRF'd via the GET admin-ajax link) can submit arbitrary orders to KRA.

    includes/admin/class-kra-etims-wc-admin.php:480-520

    Recommendation

    Require manage_woocommerce/edit_shop_orders; switch to POST + check_admin_referer; verify the user can edit the target order.

  • medium GET-based eTims submit enables CSRF

    csrf

    Submission is triggered via a GET admin-ajax.php URL with only a nonce. Cross-site GET requests can cause a logged-in merchant to submit orders unintentionally.

    includes/class-kra-etims-wc.php:190-192

    Recommendation

    Use POST forms or AJAX with check_ajax_referer; never mutate via GET.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.