WP Manifestindependent plugin directory
21stars
7forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/pathao-eng/courier-woocommerce-plugin/archive/refs/heads/main.zip

Pathao Courier Plugin For WordPress WooCommerce

Description

This WordPress plugin is designed to enhance your website's functionality by providing courier service features. Whether you need seamless package tracking or a user-friendly way to manage deliveries, our plugin has you covered.

img_7.png img_8.png

Features

  • Easy to implement
  • Sync orders to the Pathao Merchant Panel
  • Webhook Implementations
  • Real-time order status updates
  • Bulk Order Creation

Requirements

  • Requires at least: 6.0
  • Tested up to: 6.4
  • Requires PHP: 7.3
  • Stable tag: 3.18.3
  • Beta tag: 3.18.0-beta4
  • License: GPLv3

Installation

  1. Download the plugin zip file.

img.png

  1. Upload Plugin:

    • Go to the WordPress admin dashboard and navigate to 'Plugins > Add New Plugin'.

      img_1.png

    • Click 'Upload Plugin' and choose the zip file you just downloaded.

      img_2.png

    • Click 'Install Now' and activate the plugin.

      img_3.png

    • Or, unzip the file on your computer and upload the 'wordpress-pathao-courier-plugin' folder via FTP to your '/wp-content/plugins/' directory.

  2. Setup Plugin:

    • Go to the WordPress admin dashboard and navigate to 'Settings > Pathao Courier'. You will see a page 'Pathao Courier Settings' with the following options:

      img_4.png

    • Client ID: Enter your client ID and Client Secret Key, which you will get from Pathao Merchant Panel.

      img_5.png

    • Webhook URL: Enter your webhook URL, which you will get from Pathao Merchant Panel.

      img_6.png

    • Click 'Save Changes' to save your settings.

      Usage

To use, follow these steps:

  1. Add any product to the cart. Then go to the checkout page.
  2. Fill up the billing details and place the order.
  3. Go to the admin panel and check the order Woocommerce -> orders.

img_7.png

  1. Click on the 'Send with Pathao' button to send the order to the Pathao Merchant Panel.
  2. You will see a modal with the order details. Fill in the details and click on the 'Send to Pathao' button.

img_8.png

Bulk Order Creation

You can now create orders in bulk!

  1. Preload Location Data (Recommended):

    • Go to Settings > Pathao Courier.
    • Click the Preload City, Zone & Area button. This fetches and caches all location data for faster loading.

    img_9.png

  2. Select Orders:

    • Go to WooCommerce > Orders.
    • Select the orders you want to send.
    • Choose Send with Pathao from the Bulk Actions dropdown and click Apply.
  3. Bulk Order Modal:

    • If you haven't preloaded data, you will see a prompt to fetch it.

      img_10.png

    • Once loaded, you will see a grid view of your orders.

    • City, Zone, and Area will be automatically selected if you store data for any of these meta keys.

      
      _billing_pathao_city
      _billing_pathao_zone
      _billing_pathao_area

    _shipping_pathao_city _shipping_pathao_zone _shipping_pathao_area

    
    - You can edit any details directly in the grid.
    
      ![img_11.png](screenshots%2Fimg_11.png)
    
    - Click **Confirm** to create all orders at once.

Note

If you are facing any issues with the latest plugin version, you can use the previous version of the plugin from here.

License

This plugin is released under the GPL V3.

Developer Hooks

The plugin provides WordPress filters and actions for customizing modal fields and the final API payload.

Filters — Modal Field Defaults

These filters run when order data is fetched for the single/bulk modal. They let you override the default prefill values.

Filter Default Value Arguments
pathao_order_data_context [] $context, $order
pathao_modal_recipient_name Billing full name $value, $order, $context
pathao_modal_recipient_phone Billing phone $value, $order, $context
pathao_modal_recipient_address Shipping or billing address $value, $order, $context
pathao_modal_item_description Product names x quantity $value, $order, $context
pathao_modal_order_data Array of all 4 fields above $data, $order, $context

Filters — Final API Payload

These filters run in makeDto() right before the order is sent to the Pathao API. The WC order is loaded and passed for context.

Filter Arguments
pathao_order_payload_recipient_name $value, $order, $payload
pathao_order_payload_recipient_phone $value, $order, $payload
pathao_order_payload_recipient_address $value, $order, $payload
pathao_order_payload_item_description $value, $order, $payload
pathao_order_payload $payload, $order

All payload values are re-sanitized after filters run.

Actions — Lifecycle Hooks

Action When Arguments
pathao_before_send_order Before single order API call $payload, $order
pathao_after_send_order After successful single order $result, $payload, $order
pathao_send_order_failed On single order API error $errorBody, $statusCode, $payload, $order
pathao_before_send_bulk_orders Before bulk orders API call $payload
pathao_after_send_bulk_orders After successful bulk orders $result, $payload
pathao_send_bulk_orders_failed On bulk orders API error $errorBody, $statusCode, $payload

Example — Custom recipient address from order meta

add_filter( 'pathao_modal_recipient_address', function ( $address, $order, $context ) {
    $parts = array_filter( [
        $order->get_meta( '_house_no' ),
        $order->get_meta( '_road_no' ),
        $order->get_meta( '_area' ),
        $order->get_billing_city(),
    ] );

    return implode( ', ', $parts );
}, 10, 3 );

Example — Modify the final API payload

add_filter( 'pathao_order_payload', function ( $payload, $order ) {
    // Force a specific store for prepaid orders
    if ( $order->is_paid() ) {
        $payload['store_id'] = 12345;
    }
    return $payload;
}, 10, 2 );

Example — Log failed orders

add_action( 'pathao_send_order_failed', function ( $errorBody, $statusCode, $payload, $order ) {
    error_log( sprintf(
        'Pathao order #%d failed (HTTP %d): %s',
        $payload['merchant_order_id'],
        $statusCode,
        wp_json_encode( $errorBody )
    ) );
}, 10, 4 );

Support

If you have any questions or need help, please get in touch with us at

Releases

23 releases.

Tag
Published
2.1.1 latest
Sep 15, 2026 3d ago
Jul 17, 2026 2mo ago
Jul 9, 2026 2mo ago
Feb 22, 2026 6mo ago
Feb 19, 2026 7mo ago
Nov 25, 2025 9mo ago
Sep 3, 2025 1 year ago
Sep 2, 2025 1 year ago
Mar 30, 2025 1 year ago
Jan 15, 2025 1 year ago
Jan 9, 2025 1 year ago
Aug 13, 2024 2 years ago
Apr 27, 2024 2 years ago
Apr 23, 2024 2 years ago
Apr 4, 2024 2 years ago
Mar 26, 2024 2 years ago
Mar 26, 2024 2 years ago
Mar 25, 2024 2 years ago
Mar 25, 2024 2 years ago
Feb 16, 2024 2 years ago
Feb 15, 2024 2 years ago
Jan 17, 2024 2 years ago
Jan 16, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Pathao Courier 2.1.1 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
2.1.1
Findings
3
Worst severity
high
Content hash
1dd8c5660e4d17e964f84a90…

Findings

  • high Any logged-in user can fetch WooCommerce order PII via get_wc_order AJAX

    missing_capability

    wp_ajax_get_wc_order and wp_ajax_get_wc_order_bulk call getPtOrderData() which returns $order->get_data() plus billing/shipping names, phones, and addresses. There is no current_user_can check and no nonce. Any authenticated role (subscriber/customer) who can POST to admin-ajax.php can enumerate order IDs and exfiltrate customer PII.

    plugin-api.php:218-265

  • high Pathao consignment create AJAX gated only by wp_rest nonce, not shop capability

    missing_capability

    ajax_pt_hms_create_new_order and the bulk variant verify HTTP_X_WPTC_NONCE against action 'wp_rest' but never check manage_woocommerce / edit_shop_orders. Any logged-in user can obtain a wp_rest nonce (localized scripts / cookie) and create Pathao consignments using the store's API credentials, writing ptc_consignment_id meta on arbitrary orders.

    plugin-api.php:126-216

  • medium Courier geo/store AJAX helpers lack capability and nonce checks

    missing_capability

    get_stores, get_cities, get_zones, get_areas, and bulk zone/area list handlers are wp_ajax-only with no capability or nonce verification. Any logged-in user can pull Pathao store/city/zone configuration through the merchant API token held in options.

    plugin-api.php:58-109

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.