WP Manifestindependent plugin directory
manifest / ecommerce / test-orders-for-woocommerce

Test Orders for WooCommerce® WP RegistryHigh-severity findings · 1 findingOpen the reportC-

by Robert DeVore · github.com/robertdevore/test-orders-for-woocommerce · website

★ 7stars
27release downloads
≈10active sites
1.1.0latest · 1 year ago

Install

Download test-orders-for-woocommerce.zip From the 1.1.0 release on GitHub, Feb 18, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/robertdevore/test-orders-for-woocommerce/releases/download/1.1.0/test-orders-for-woocommerce.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/robertdevore/test-orders-for-woocommerce ↗

Test Orders for WooCommerce® is a lightweight plugin that adds a "Test Order" option to your WooCommerce store, allowing you to place test orders without requiring payment.

Perfect for staging environments or testing new WooCommerce setups.

Features

  • Test Order Payment Gateway: Adds a "Test Order" option to your checkout.
  • Customizable Settings: Configure the order status and whether to reduce stock levels for test orders.
  • Seamless WooCommerce Integration: Built using WooCommerce hooks and standards.
  • Developer-Friendly: Easily extensible for advanced use cases.
  • Localization Ready: Fully translatable with .mo/.po files.

Installation

From the WordPress Admin Dashboard:

  1. Download the latest release from GitHub.
  2. Go to Plugins > Add New > Upload Plugin.
  3. Upload the downloaded ZIP file and activate the plugin.
  4. Ensure WooCommerce® is active.

Manual Installation:

  1. Upload the test-orders-for-woocommerce folder to the /wp-content/plugins/ directory.
  2. Activate the plugin through the Plugins menu in WordPress.
  3. Ensure WooCommerce® is active.

Usage

Enabling Test Orders

  1. Go to WooCommerce > Settings > Payments.
  2. Enable the "Test Order" payment gateway.

Customizing Test Order Behavior

  1. Navigate to WooCommerce > Test Orders.
  2. Configure the following options:
    • Order Status: Choose the default status for test orders (Completed, Processing, On Hold, or Pending).
    • Reduce Stock: Determine whether stock levels should decrease when processing test orders.

Example Use Case

Use the "Test Order" gateway in staging environments to verify order workflows, email notifications, and other post-purchase functionalities without actual payments.

Development

Prerequisites

  • WordPress® Version: 5.0 or higher
  • WooCommerce® Version: 4.0 or higher

Code Structure

  • Custom Payment Gateway: Implements WooCommerce's WC_Payment_Gateway class.
  • Admin Settings Page: Accessible via WooCommerce > Test Orders.

Extending the Plugin

Developers can customize plugin behavior by using filters and actions. For example, modify the default test order status:

add_filter( 'wc_test_order_status', function( $status ) {
    return 'on-hold';
});

Updating the Plugin

This plugin uses YahnisElsts/Plugin Update Checker for automatic updates via GitHub.

Security

  • Input Sanitization: All user inputs are sanitized using WordPress functions.
  • Nonce Protection: Nonces are used for all settings forms to prevent CSRF attacks.
  • Escaping Outputs: Proper escaping is applied to all outputs in the admin panel.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Feb 18, 2025 1 year ago
test-orders-for-woocommerce.zip
22
1.0.0
Feb 13, 2025 1 year ago
test-orders-for-woocommerce.zip
5

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Test Orders for WooCommerce® 1.1.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.0
Findings
1
Worst severity
high
Content hash
c17c5966bddf563aa4bf6c0f…

Findings

  • high Test payment gateway is enabled by default and unrestricted, completing unpaid orders

    insecure_config

    WC_Gateway_Test_Order is registered on woocommerce_payment_gateways as soon as WooCommerce boots. init_form_fields() sets enabled default to yes. The class never assigns a custom is_available() and never checks current_user_can, WP_ENVIRONMENT_TYPE, or a staging flag, so parent WC_Payment_Gateway::is_available() is only 'yes' === $this->enabled. WC_Settings_API::init_settings() copies that form default into $this->settings when option woocommerce_test_order_settings does not exist yet — i.e. immediately after activation, before anyone visits WooCommerce → Settings → Payments. README usage still tells operators to 'enable' the gateway, which does not match the code. process_payment() then (1) stores _payment_method=test_order, (2) update_status(get_option('wc_test_order_status','completed')), (3) wc_reduce_stock_levels() unless wc_test_order_reduce_stock was changed from yes. Classic checkout will list the method. Checkout Blocks may hide it in the UI (this plugin never registers a Blocks payment-method type), but WooCommerce Store API /wp-json/wc/store/v1/checkout still accepts payment_method=test_order because get_available_payment_gateways() is PHP is_available() and StoreApi\Legacy::process_legacy_payment() calls this class's process_payment(). Observable: on a default WooCommerce site, activate this plugin, add any product, choose Test Order or POST payment_method=test_order to the Store API — the order is completed without payment, downloadable access is granted, stock drops, and completed-order mail fires. This is a production footgun for a tool the README itself scopes to staging; COD/BACS in WooCommerce core default enabled to no and do not auto-complete. Shop manager can later disable the gateway; until then every visitor has a free checkout path.

    test-orders-for-woocommerce.php:163-242

    Recommendation

    Default the enabled checkbox to no so activation is not a live free-checkout button. Override is_available() to return false for users who cannot manage_woocommerce (or gate on an explicit 'allow guest test checkout' setting that defaults off). Refuse to enable the gateway when wp_get_environment_type() is production unless a separate acknowledged option is set. Do not default order status to completed; pending or on-hold is safer for a test method. Keep a loud admin notice while the gateway is enabled.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →