WP Manifestindependent plugin directory

Install

Download barcodes-for-woocommerce.zip From the 0.0.2 release on GitHub, Feb 18, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/robertdevore/barcodes-for-woocommerce/releases/download/0.0.2/barcodes-for-woocommerce.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Barcodes for WooCommerce® is a plugin designed to simplify order and product management by automatically generating unique QR codes for orders and products.

These QR codes are integrated into the WooCommerce experience, including emails, admin pages, and customer-facing order details.

This plugin is purposefully focused on QR codes for version 0.0.1, and I'm seeking feedback from the community to determine which barcode formats would provide the most value in future releases.

I'm aiming to prioritize features that are truly useful rather than adding every possible format or feature just because you know who does it.

Features

  • Order QR Codes: Automatically generate QR codes for all new orders.
  • Product QR Codes: Generate unique QR codes for products without existing codes.
  • Email Integration: Include QR codes in customer order confirmation emails.
  • Admin Integration: Display QR codes in the admin order details page.
  • Shortcode Support: Display QR codes anywhere using the [order_barcode] shortcode.
  • AJAX Functionality: Lookup and generate QR codes dynamically.
  • Settings Page: Customize QR code settings, including color.

Planned Features

I want to hear from you! Let me know which barcode formats (e.g., Code128, EAN, UPC) you see most often and would like included in future versions.

My goal is to keep the plugin lean and focus on the most practical use cases.

Installation

  1. Download the plugin zip file from the releases page.
  2. Upload the plugin to your WordPress site:
    • Navigate to Plugins > Add New.
    • Click Upload Plugin and choose the zip file.
    • Click Install Now and then Activate.
  3. Configure the plugin settings:
    • Go to Barcodes in the WordPress admin menu.
    • Customize settings as needed.

Usage

Automatic QR Code Generation

  • Orders: QR codes are generated automatically for all new orders.
  • Products: QR codes can be generated for products manually or in bulk via the Advanced Settings tab.

Display QR Codes

  • Order Details: QR codes are displayed on the thank you page, in the admin dashboard, and in customer emails.
  • Shortcodes: Use [order_barcode order_id="123"] to display an order's QR code anywhere on your site.

Email Integration

The plugin appends the order QR code to the customer order confirmation email for easy scanning and retrieval of order details.

Contributing

I welcome contributions! Here's how you can help:

  1. Fork the repository.
  2. Create a new feature branch: git checkout -b feature/my-feature.
  3. Commit your changes: git commit -m 'Add my feature'.
  4. Push to the branch: git push origin feature/my-feature.
  5. Open a pull request.

License

This plugin is licensed under the GPL-2.0+ license. See the LICENSE file for more details.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.0.2 latest
Feb 18, 2025 1 year ago
barcodes-for-woocommerce.zip
37
Nov 20, 2024 1 year ago
barcodes-for-woocommerce.zip
2
D+ grade

Security

Barcodes for WooCommerce® 0.0.2 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
0.0.2
Findings
3
Worst severity
high
Content hash
a9ab9dfac9da3441e710df16…

Findings

  • high Unauthenticated barcode lookup discloses order and customer PII

    information_disclosure

    wp_ajax_nopriv_lookup_barcode accepts a barcode and returns order ID, status, billing name, email, phone, and address with no authentication, capability check, or nonce. Anyone who obtains a barcode (packing slip, customer email shortcode, or leaked meta) can enumerate order/customer PII.

    classes/BarcodesForWooCommerce.php:296-331

    Recommendation

    Remove nopriv registration; require manage_woocommerce (or similar) plus a nonce. Do not return PII to unauthenticated clients.

  • high Barcode generation AJAX missing capability and nonce checks

    missing_capability

    generate_order_barcodes and generate_product_barcodes are registered only as wp_ajax_* (logged-in) but never call current_user_can or wp_verify_nonce. Any authenticated Subscriber can batch-write _barcode / _product_barcode post meta.

    classes/BarcodesForWooCommerce.php:135-179

    Recommendation

    Require manage_woocommerce (or manage_options) and verify a nonce localized only on the admin page before generating barcodes.

  • medium Generate barcode AJAX missing nonce (CSRF for any logged-in user)

    csrf

    The generate_* AJAX actions have no wp_verify_nonce. A malicious page can CSRF a logged-in subscriber/admin into bulk-writing barcode meta.

    classes/BarcodesForWooCommerce.php:244-294

    Recommendation

    Add check_ajax_referer / wp_verify_nonce tied to an admin-only localized nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.