WP Manifestindependent plugin directory
manifest / integrations / gumroad-api

Gumroad API WordPress WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

A WordPress plugin that automatically creates user accounts when customers purchase products from your Gumroad store. Connect Gumroad API.

★ 1stars
22release downloads
v0.7latest · 9mo ago

Install

Download gumroad-api.zip From the v0.7 release on GitHub, Jan 2, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sinanisler/gumroad-api/releases/download/v0.7/gumroad-api.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Gumroad API WordPress Plugin



A WordPress plugin that automatically creates user accounts when customers purchase products from your Gumroad store.

image image

Features

  • Automatic User Creation - Creates WordPress accounts automatically when customers buy from Gumroad
  • Webhook Support - Real-time processing via Gumroad webhooks
  • Cron Job Monitoring - Regular checks for new sales via API
  • Role Assignment - Set default user roles or assign specific roles based on products
  • Welcome Emails - Send customizable HTML welcome emails with login credentials
  • Activity Logging - Track all API activities and user creations
  • Password Reset Links - Automatically include password reset URLs in welcome emails

Dynamic Email Tags

Customize welcome emails with these tags:

  • {{site_name}} - Your site name
  • {{site_url}} - Your site URL
  • {{product_name}} - Purchased product name
  • {{username}} - Generated username
  • {{password}} - Generated password
  • {{email}} - User's email
  • {{login_url}} - WordPress login URL
  • {{password_reset_url}} - Password reset link

Settings

  • Connection - Configure Gumroad API access token and webhook URL
  • User Roles - Set default roles and product-specific role assignments
  • Welcome Email - Customize email subject and HTML template
  • Cron Settings - Configure check intervals and sales limits
  • Logs - View and manage API activity logs

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.7 latest
Jan 2, 2026 9mo ago
gumroad-api.zip
11
Jan 1, 2026 9mo ago
gumroad-api.zip
5
Dec 25, 2025 10mo ago
gumroad-api.zip
3
Dec 25, 2025 10mo ago
gumroad-api.zip
2
Dec 25, 2025 10mo ago
gumroad-api.zip
1
B grade

Security

Gumroad API WordPress 0.7 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.7
Findings
1
Worst severity
medium
Content hash
30d9c7c6247c8955ab5bd313…

Findings

  • medium Privileged roles (including administrator) assignable to Gumroad buyers

    insecure_config

    Settings UI iterates all $wp_roles->roles for default_roles and product_roles with no exclusion of administrator/editor. sanitize_settings stores those role keys; process_sale then set_role/add_role on new or existing users. A mistaken admin configuration (or compromised admin session writing settings) grants full site control to anyone who purchases a mapped product.

    gumroad-api.php:1410-1420

    Recommendation

    Exclude administrator (and ideally editor/shop_manager) from selectable roles; hard-deny privileged roles in process_sale regardless of settings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.