WP Manifestindependent plugin directory
manifest / ecommerce / tdws-order-tracking-system

TDWS Order Tracking System WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

This plugin simplifies order tracking for your store, allowing you to efficiently manage both single and multi-product orders.

★ 1stars
v1.2.4latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tdwebservices-official/tdws-order-tracking-system/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

TDWS Order Tracking System

Plugin Developer: TD Web Services

This plugin provides a comprehensive order tracking system for your WordPress store, allowing you to manage single and multi-product orders efficiently.

Features:

  • Manual Tracking Entry: Agents can update tracking details for orders using a predefined form.
  • Multi-Product Order Handling: Specify if products in an order ship together or individually.
  • Product-Level Tracking: Track individual products within multi-product orders. (For orders with separate tracking numbers)
  • Customer Notifications: Automatic email notifications to customers upon entering tracking details.
  • Customer-Facing Tracking: Customers can view tracking information directly on the order details page.
  • Order Tags: Assign and manage custom tags to orders for improved workflow and filtering. (e.g., "Processing," "Awaiting Stock")
  • Seamless Integration: Integrates with your existing WordPress order management system.
  • Version Control: Utilizes a dedicated GitHub repository for version control, collaboration, and issue tracking.
  • Automatic Updates: Receive updates seamlessly through the WordPress plugin update mechanism.
  • Coupon Management:
    • Coupon Categories or Interests:
      • Organize coupons based on customer preferences.
    • Brand Information:
      • Manage brand details, including Brand Name and Logo.
    • Coupons:
      • Define Coupon Name, Coupon Code, Offer Highlights, Link, and Expiry/Validity Date.
    • Display Locations:
      • Order Confirmation Page
      • My Dashboard (Coupons displayed based on selected interests; if none, all coupons are shown)
    • Display Conditions:
      • Coupons with expired or invalid validity dates will not be displayed.
  • Order Auto-Completion for Failed or Untracked Delivery:
    • Set a specific number of days post-order date or choose a status for auto-completion.
    • Configure a reminder email before the order is set to be completed.
    • Customizable email body for notifying customers.

Future Enhancements (Not included in current version):

  • Automatic Shipment Status Updates (API Integration):
    • Integrate with major shipment companies (FedEx, UPS, USPS, DHL) for real-time tracking updates.
    • Reduce manual work and improve data accuracy.
  • Enhanced Customer Interface:
    • Progress Bar: Visually represent shipment journey stages (e.g., "Order Placed," "Delivered").
    • Estimated Delivery Date: Display an estimated delivery date based on shipment information.
    • Delivery Notifications: Send automated notifications to customers at key stages (e.g., "Order Shipped").
    • Customization Options: Allow customization of progress bar stages, notification triggers, and content.
    • Channel Options: Offer email or SMS notifications based on customer preferences.
  • Advanced Tracking Features:
    • Package-Level Tracking: Allow customers to track individual packages within multi-product orders.
    • Exception Handling: Identify and notify agents about potential delivery exceptions.
    • Returns Management: Integrate with your returns management system for easy return initiation.
    • Proof of Delivery: Explore options for capturing and displaying proof of delivery (e.g., signature confirmation).
  • Reporting and Analytics:
    • Track delivery performance metrics (average delivery times, on-time delivery rates).
    • Identify delivery trends for proactive adjustments.

Installation:

  1. Upload the plugin zip file to your WordPress plugins section.
  2. Activate the plugin.

Configuration:

  • No additional configuration required for basic functionality.
  • Refer to the WordPress documentation for managing custom tags (if applicable).

Support:

For any questions or support requests, please contact TD Web Services at tdwebservices.com.

Releases

19 releases.

Tag
Published
v1.2.4 latest
Jun 16, 2025 1 year ago
Jun 13, 2025 1 year ago
Feb 2, 2025 1 year ago
Jan 30, 2025 1 year ago
Jan 5, 2025 1 year ago
Dec 1, 2024 1 year ago
Oct 1, 2024 2 years ago
Aug 28, 2024 2 years ago
Aug 16, 2024 2 years ago
Aug 15, 2024 2 years ago
Aug 13, 2024 2 years ago
Aug 13, 2024 2 years ago
Aug 13, 2024 2 years ago
Aug 13, 2024 2 years ago
Aug 12, 2024 2 years ago
Jun 26, 2024 2 years ago
Jun 7, 2024 2 years ago
May 30, 2024 2 years ago
May 23, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

TDWS Order Tracking System 1.2.4 · audited by WP Registry

High-severity findings.

2 high 2 medium
Audited release
1.2.4
Findings
4
Worst severity
high
Content hash
281ba363cbad7b2e9374aeda…

Findings

  • high Unauthenticated AJAX sends customer reminder and failed-order emails

    missing_auth

    tdws_auto_completed_reminder_set_mail_cron and tdws_failed_order_remind_me_again are nopriv AJAX with no auth. When those features are enabled, anyone can trigger bulk wp_mail/tdws_custom_send_mail to order billing addresses (spam/phishing using the store's identity) and flip reminder meta.

    admin/includes/class-tdws-order-tracking-system-order-metabox.php:69-70,76-78,598-691,756-773

    Recommendation

    Drop nopriv hooks. Gate with a capability or HMAC cron secret and a nonce. Rate-limit and do not allow on-demand blast of all matching orders from the public AJAX endpoint.

  • high Unauthenticated 17track cron AJAX with no nonce

    missing_auth

    tdws_push_17track_api_cron and tdws_push_17track_api_single_cron are registered nopriv and perform unauthenticated option writes plus outbound 17track API work over store tracking numbers. An attacker can repeatedly trigger API usage, advance the batch pointer, and cause tracking-status mail as a side effect of the single cron.

    admin/includes/class-tdws-17tracking-automation.php:49-54,64-80,89-118

    Recommendation

    Use WP-Cron or a secret token. Remove nopriv AJAX. Add capability and nonce checks before any option/API work.

  • medium Public nonce lets unauthenticated users read tracking email templates

    information_disclosure

    tdws_tracking_get_mail_body_data is nopriv and only checks ajax_nonce against tdws_form_save. The public enqueue localizes that nonce for every visitor (including uid 0), so anyone can retrieve tdws_{option_key}_mail_obj HTML email templates.

    admin/class-tdws-order-tracking-system-admin.php:52-53,944-965

    Recommendation

    Remove nopriv. Require manage_woocommerce (or similar) in addition to the nonce. Do not localize admin nonces on the public script.

  • medium Logged-in Subscriber can run schema migration AJAX

    missing_capability

    tdws_sync_tdws_tables is wp_ajax_ (any authenticated user) with no nonce or current_user_can check. A Subscriber can trigger SHOW TABLES / dbDelta / extra column adds on the tracking tables.

    admin/class-tdws-order-tracking-system-admin.php:101,1325-1359

    Recommendation

    Require manage_woocommerce and check_ajax_referer before any DDL.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.