WP Manifestindependent plugin directory
manifest / ecommerce / wms-data-transfer-wordpress-woocommerce-addon

SmartPack - WMS Data Integration WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress SmartPack plugin to WooCommerce with full integration to smartpack.dk system.

by SmartPack · github.com/smartpackwms/wms-data-transfer-wordpress-woocommerce-addon

★ 2stars
7composer installs
0.0.2.1latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/smartpackwms/wms-data-transfer-wordpress-woocommerce-addon/archive/refs/heads/main.zip

On Packagist as smartpack/wordpress-woocommerce-plugin:

composer require smartpack/wordpress-woocommerce-plugin
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/smartpackwms/wms-data-transfer-wordpress-woocommerce-addon ↗

wms-data-transfer-wordpress-plugin-woocommerce

Webhook rules

Hooks Smartpack WMS need endpoints to update different data for product, stock and order there will be some REST API endpoints for that. remeber to add a webhook key in the settings area else its have disabled security and all can sending webhook to your store.

Stock changed webhook

{domain-path}/wp-json/smartpack-wms/v1/stock-changed

Order changed webhook

{domain-path}/wp-json/smartpack-wms/v1/order-changed

Crontab

All data between SmartPack WMS and Woocommerce will be synced. We are using WordPress built-in cron-scheduler for processing order and product data, if you disabled the built-in cron-scheduler in WordPress, you need to run add custom-cronjob inside your crontab file and be sure to install the WP CLI on your system.

* * * * * wp cron event run wms_cron_product_hook
* * * * * wp cron event run wms_cron_order_hook

You can also use WP CLI to trigger cron events manually or delete existing cron events if something goes wrong.

wp cron event run --due-now --allow-root
wp cron event delete wms_cron_product_hook --allow-root

Product hint:

  • Simple product use its own SKU
  • Product variations need there own SKU else its used parent SKU.

Module Featuers

WMS

  • Product
    • CLI: Full sync of products from shop to WMS integration
  • Order
    • CLI: Sync all with shipment status
  • Stock
    • Hook: update product stock on hook signals
    • CLI: Full stock sync to be ajour from WMS into Woo

Woocommerce order process

Custom orders will not be automatically transfered to the WMS integration.

Releases

3 releases.

Tag
Published
0.0.2.1 latest
May 29, 2022 4 years ago
0.0.2
May 29, 2022 4 years ago
0.0.1
Jan 27, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

SmartPack - WMS Data Integration 0.0.2 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
0.0.2
Findings
2
Worst severity
high
Content hash
1025440f11cfaa43ecae2698…

Findings

  • high Unauthenticated/weak-auth WMS order and product export REST endpoints

    auth_bypass

    exportProducts and exportOrders are registered without permission_callback (WordPress treats missing callbacks as publicly accessible). Authentication is a non-constant-time string compare of Authorization Bearer to settings[wordpress_access_key]. When the access key is empty (default UI value), a request with Authorization: Bearer yields an empty token that equals the empty setting and returns product/order export payloads including customer data.

    src/Controllers/RestRoutes_Controller.php:53-69,192-255

    Recommendation

    Add permission_callback that requires a non-empty access key and hash_equals comparison; refuse requests when wordpress_access_key is empty. Prefer Application Passwords or WooCommerce REST keys.

  • medium Missing permission_callback on WMS export REST routes

    missing_permission_callback

    Both export routes omit permission_callback, relying solely on ad-hoc checks inside the callback. This widens exposure and conflicts with WordPress REST best practices.

    src/Controllers/RestRoutes_Controller.php:53-69

    Recommendation

    Always set an explicit permission_callback that performs the bearer validation (and rejects empty keys).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →