WP Manifestindependent plugin directory
manifest / ecommerce / mass-data-ltd-woocommerce-otp-system

MassData OTP Pro WP Registry grade D. High-severity findings · 5 findingsWP RegistryHigh-severity findings · 5 findingsOpen the reportD

MassData OTP Pro is a powerful WooCommerce extension that adds phone number verification via OTP (One-Time Password) during user registration. Built with security and customization in mind, it provides complete control over the verification process through an intuitive admin dashboard.

★ 1stars
Version_5.0.0latest · 6mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/moursalinislambd/mass-data-ltd-woocommerce-otp-system/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Enterprise-grade SMS OTP verification for WooCommerce + Full Order SMS Notification System

A comprehensive SMS solution for WooCommerce that combines phone number verification during registration with automated order status notifications via the MassData SMS gateway.

🚀 Features

📱 OTP Phone Verification

  • SMS OTP verification during WooCommerce registration

  • Real-time phone validation with Bangladesh mobile number format (01XXXXXXXXX)

  • AJAX-based OTP sending – no page reload required

  • 5-minute OTP expiry for security

  • Customizable company name in SMS templates

  • Auto-save verified phone number to user's billing phone field

🛒 Order SMS Notifications

  • Automatic SMS alerts for order status changes

  • Customizable SMS templates for each order status:

    • Pending Payment (অপেক্ষমাণ পেমেন্ট)

    • Processing (প্রসেসিং)

    • On Hold (হোল্ড)

    • Completed (সম্পন্ন)

    • Cancelled (বাতিল)

    • Refunded (ফেরত)

    • Failed (ব্যর্থ)

  • New order SMS notification on placement

  • Admin notification option with customizable phone number

  • Multi-status activation – choose which statuses trigger SMS

  • Test SMS feature to validate templates

📝 SMS Templates

  • Separate templates for each order status

  • Rich variable support for dynamic content:

    • {customer_name} – Customer's full name

    • {order_id} – Order number

    • {order_total} – Order total amount

    • {order_status} – Current order status

    • {payment_method} – Payment method used

    • {shop_name} – Website/blog name

    • {order_date} – Order creation date

    • {billing_address} – Customer's billing address

    • {shipping_address} – Customer's shipping address

    • {items_list} – List of ordered items with quantities

    • {customer_note} – Customer's order note

📊 SMS Logs

  • Complete history of all sent SMS

  • Success/failure tracking with error messages

  • Searchable log table with order linking

  • Last 500 entries storage with auto-cleanup

  • One-click log clearing option

🔧 Admin Features

  • Dedicated admin menu with sub-pages:

    • OTP Settings – API configuration and test

    • Order SMS – Notification settings and test

    • SMS Templates – Customize messages per status

    • SMS Logs – View and manage sent messages

  • API testing tool to verify gateway connection

  • Balance check via MassData API

  • Security integrity check with tampering protection

📋 Requirements

RequirementMinimumWordPress5.8+PHP8.0+WooCommerceLatest versionSMS GatewayMassData API credentials

🔌 Installation

  1. Upload the plugin to /wp-content/plugins/massdata-otp-pro/

  2. Activate the plugin through the WordPress admin panel

  3. Ensure WooCommerce is active

  4. Configure API credentials in MassData SMS Pro → OTP Settings

  5. Enable OTP verification and/or Order SMS as needed

⚙️ Configuration Guide

Step 1: API Configuration

Navigate to MassData SMS Pro → OTP Settings:

  • Enter your API Key

  • Enter your Sender ID

  • Set your Company Name (appears in SMS)

  • Click Save Settings

Step 2: Test API Connection

  • Click API Test করুন to verify credentials

  • If successful, your balance will be displayed

Step 3: Enable OTP Verification

  • Check OTP Verification চালু করুন

  • Save settings – OTP field will appear on registration page

Step 4: Configure Order SMS

Navigate to MassData SMS Pro → Order SMS:

  • Enable Order SMS পাঠানো সক্রিয় করুন

  • Choose which order statuses trigger SMS

  • Optionally enable Admin notification with admin phone number

  • Save settings

Step 5: Customize SMS Templates

Navigate to MassData SMS Pro → SMS Templates:

  • Edit templates for each order status

  • Use available variables for dynamic content

  • Enable/disable individual status templates

  • Save templates

📱 SMS Template Examples

Processing Order (প্রসেসিং)

প্রিয় {customer_name},

আপনার অর্ডার #{order_id} প্রসেস হচ্ছে।

মোট: {order_total}

ধন্যবাদ, {shop_name}

Completed Order (সম্পন্ন)

প্রিয় {customer_name},

আপনার অর্ডার #{order_id} সফলভাবে ডেলিভারি হয়েছে।

আমাদের সাথে থাকুন।

{shop_name}

🔒 Security Features

  • Footer integrity check – prevents plugin tampering

  • Tampering logging – records unauthorized modifications

  • Nonce validation on all AJAX requests

  • Capability checks for admin actions

  • OTP expiry (5 minutes) for security

  • Phone number format validation (Bangladesh format)

🛡️ Integrity Protection

The plugin includes a unique footer protection system:

  • If plugin footer is modified, OTP functionality is automatically disabled

  • Tampering attempts are logged to /wp-content/massdata-security.log

  • A visual security alert is displayed in admin panel

🌐 Language Support

  • Bengali interface text throughout admin panel

  • English fallback support

  • SMS templates support both Bengali and English content

  • Admin menu items with Bengali descriptions

📊 SMS Log Format

Each log entry includes:

  • Timestamp – Date and time of sending

  • Order ID – Link to edit order

  • Phone number – Recipient's number

  • Status – Order status that triggered SMS

  • Message – Actual SMS content sent

  • Result – Success/Failure status with error details

🧪 Testing

Test OTP Verification

  1. Go to WooCommerce registration page

  2. Enter a valid Bangladesh phone number (01XXXXXXXXX)

  3. Click OTP পাঠান

  4. Enter the received OTP

  5. Complete registration

Test Order SMS

  1. Go to MassData SMS Pro → Order SMS

  2. Scroll to টেস্ট SMS পাঠান section

  3. Enter a phone number

  4. Select an order status

  5. Click 📤 টেস্ট SMS পাঠান

  6. Verify the test message is received

👨‍💻 Developer Information

Developer: Moursalin IslamEmail: morsalinislam.net@gmail.comAgency: OnexusDevWebsite: onexusdev.xyzSupport: onexusdev@gmail.com

📄 License

GPL v2 or laterhttps://www.gnu.org/licenses/gpl-2.0.html

🙏 Acknowledgments

  • WooCommerce for providing the e-commerce framework

  • MassData for SMS gateway services

  • WordPress community for plugin development standards

🔄 Changelog

Version 5.0.0

  • Complete plugin rewrite with enhanced security

  • Added Order SMS notification system

  • Added customizable SMS templates per order status

  • Added SMS logging with admin interface

  • Added API testing tool

  • Added admin notification option

  • Enhanced footer integrity protection

  • Bengali language support throughout admin

  • Multiple order status support

Code The Future, Live The DreamOnexusDev

Releases

2 releases.

Tag
Published
Version_5.0.0 latest
Mar 30, 2026 6mo ago
Mar 5, 2026 7mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D grade

Security

MassData OTP Pro 5.0.0 · audited by WP Registry

High-severity findings.

2 high 2 medium 1 low
Audited release
5.0.0
Findings
5
Worst severity
high
Content hash
4fb69af64d12e7b0979dbf8a…

Findings

  • high SMS logs AJAX missing capability check

    missing_capability

    ajax_get_sms_logs verifies nonce massdata_logs but never calls current_user_can. Any authenticated user can create that nonce and retrieve massdata_sms_logs (phone numbers and message contents).

    wc-massdata-otp-advanced.php:800-804

    Recommendation

    Require current_user_can('manage_options') after the nonce check.

  • high Unauthenticated footer-tampering AJAX disables the plugin

    missing_auth

    check_footer_tampering is registered for nopriv. handle_footer_tampering only checks footer_check nonce then sets settings[enabled]=0 and update_option. Unauthenticated visitors (nonce creatable for uid 0, and nonce also embedded in frontend footer script) can disable OTP/SMS functionality.

    wc-massdata-otp-advanced.php:911-912,1041-1047

    Recommendation

    Remove nopriv registration; require manage_options. Do not disable security features from a public AJAX endpoint.

  • medium Public OTP send enables SMS cost abuse

    dos

    nopriv pro_send_otp only checks pro_nonce (printed on account registration page and forgeable for uid 0) then sends SMS via configured API key. Attackers can bomb arbitrary BD phone numbers and drain SMS balance.

    wc-massdata-otp-advanced.php:82-85,952-972

    Recommendation

    Add rate limiting by IP/phone, CAPTCHA, and stricter nonce binding; consider blocking unauthenticated flooding.

  • medium test_api AJAX missing capability check

    missing_capability

    test_api checks test_pro nonce then calls remote SMS balance API with attacker-supplied key; no manage_options gate.

    wc-massdata-otp-advanced.php:848-865

    Recommendation

    Require manage_options; enable SSL verification.

  • low wp_remote_get disables SSL verification

    insecure_config

    test_api and similar calls set sslverify => false, enabling MITM on SMS API traffic including API keys.

    wc-massdata-otp-advanced.php:852-855

    Recommendation

    Use default SSL verification (true).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.