WP Manifestindependent plugin directory
manifest / ecommerce / rs-woocommerce-purchase-notifier

RS WooCommerce Purchase Notifier WP RegistryMedium-severity findings · 1 findingOpen the reportB

[WordPress Plugin] Set up custom email notifications to be sent based on a WooCommerce purchase of a specified product.

by Radley Sustaire, ZingMap LLC · github.com/radgh/rs-woocommerce-purchase-notifier

★ 0stars
9release downloads
v1.0.1latest · 10mo ago

Install

Download rs-woocommerce-purchase-notifier-v1.0.1.zip From the v1.0.1 release on GitHub, Dec 2, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/radgh/rs-woocommerce-purchase-notifier/releases/download/v1.0.1/rs-woocommerce-purchase-notifier-v1.0.1.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Readme github.com/radgh/rs-woocommerce-purchase-notifier ↗

RS WooCommerce Purchase Notifier (WordPress Plugin)

Set up custom email notifications to be sent based on a WooCommerce purchase of a specified product.

Plugin thumbnail

Description

This plugin allows you to add email addresses to individual products. When a customer purchases the product, an email notification is sent to the specified email addresses.

Changelog

1.0.1

  • Added Alchemy Updater support to enable automatic updates

1.0.0

  • Initial release

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.1 latest
Dec 2, 2025 10mo ago
rs-woocommerce-purchase-notifier-v1.0.1.zip
9
v1.0.0
Dec 2, 2025 10mo ago
rs-woocommerce-purchase-notifier-v1.0.0.zip
0
B grade

Security

RS WooCommerce Purchase Notifier 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
7211ff5f7238e3c993b42e90…

Findings

  • medium Purchase-notifier metabox save missing nonce

    missing_nonce

    save_notification_emails_metabox hooked to save_post_product writes _rs_wc_purchase_notifier_emails from $_POST without verifying a nonce or explicitly checking edit_post. Core still restricts who can save the product, but CSRF against an authenticated product editor is possible.

    includes/products.php:117-134

    Recommendation

    Verify a metabox nonce and current_user_can('edit_post', $post_id) before updating meta; skip autosaves.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →