WP Manifestindependent plugin directory
manifest / ecommerce / superwp-woocommerce-stocktaking

superWP Woo Stocktake WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

WooCommerce Stocktaking simplifies inventory management with tools for efficient and accurate stocktakes. Enjoy real-time updates, user-friendly entry interfaces, and detailed reporting. Seamlessly integrated with WooCommerce, it helps maintain optimal inventory levels and prevents discrepancies. Keep your stock in check effortlessly.

by Thiarara SuperWP · github.com/thiararapeter/superwp-woocommerce-stocktaking · website

★ 3stars
1.0.02latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/thiararapeter/superwp-woocommerce-stocktaking/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/thiararapeter/superwp-woocommerce-stocktaking ↗

A comprehensive stocktaking system for WooCommerce with count transfer, reset functionality, and detailed reporting.

Description

superWP Woo Stocktake is a powerful inventory management solution for WooCommerce stores. It provides a robust set of tools for conducting accurate stocktakes, managing discrepancies, and generating detailed reports.

Key Features

  • Conduct stocktakes with ease
  • Transfer counted stock to WooCommerce
  • Reset functionality for new stocktakes
  • Detailed discrepancy analysis
  • Audit and follow-up system
  • Comprehensive reporting

Installation

  1. Upload the plugin files to the /wp-content/plugins/superwp-woo-stocktake directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress.
  3. Use the WooCommerce -> Stocktaking menu to access the plugin's features.

Usage

  1. Initiate a stocktake from the WooCommerce -> Stocktaking menu.
  2. Count your inventory using the provided interface.
  3. Review discrepancies in the generated report.
  4. Conduct audits and follow-ups on discrepancies.
  5. Generate detailed reports for analysis.
  6. Transfer final counts to WooCommerce to update stock levels.

Features in Detail

  1. Stocktake Initiation: Start a new stocktake process with a single click.
  2. Counting Interface: User-friendly interface for entering counted stock quantities.
  3. Discrepancy Analysis: Automatically calculates and highlights discrepancies.
  4. Audit System: Allows for follow-up actions on discrepancies.
  5. Reporting: Generates comprehensive reports on stocktake results.
  6. Stock Transfer: Option to update WooCommerce stock levels with counted quantities.
  7. Reset Functionality: Reset counted stock for new stocktakes.
  8. Data Visualization: Presents stocktake data in an easy-to-understand format.

Requirements

  • WordPress 5.0 or higher
  • WooCommerce 3.0 or higher
  • PHP 7.2 or higher

Support

For support queries, feature requests, and bug reports, please open an issue on this repository.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the GPL-2.0+ License - see the LICENSE file for details.

Author

Thiarara Peter

Changelog

1.0.02

  • Added "Open To Audit" functionality for improved audit workflow
  • Updated UI for better user experience in audit process

1.0.01

  • Initial release

Releases

2 releases.

Tag
Published
1.0.02 latest
Oct 21, 2024 2 years ago
0.9.9
Jun 5, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

superWP Woo Stocktake 1.0.02 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
1.0.02
Findings
3
Worst severity
high
Content hash
21c246b2fe4f5e85e46781d5…

Findings

  • high Stock count AJAX lacks capability check (nonce-only auth)

    missing_capability

    wc_stocktaking_update_count and wc_stocktaking_save_count verify check_ajax_referer('wc_stocktaking_nonce') but never call current_user_can. Any logged-in user (Subscriber/Customer) can mint a valid nonce for that action and write arbitrary _counted_stock post meta on WooCommerce products, corrupting inventory counts used by the stocktake closing flow.

    core/class-superwp-woo-stocktake.php:423-482

    Recommendation

    Require current_user_can('manage_woocommerce') or manage_options (matching the admin menus) before updating product meta; reject other roles.

  • medium Product search AJAX missing capability check

    missing_capability

    wc_stocktaking_search_products is nonce-gated only. Any authenticated user can search and receive product stock HTML for the active stocktake categories.

    core/class-superwp-woo-stocktake.php:517-560

    Recommendation

    Add the same manage_woocommerce/manage_options capability check used by the stocktaking admin UI.

  • low Unnecessary nopriv registration for reopen_audit

    unnecessary_attack_surface

    wp_ajax_nopriv_reopen_audit is registered, expanding unauthenticated attack surface. The handler still requires manage_options so unauth callers fail, but the nopriv hook is unnecessary.

    core/includes/classes/class-superwp-woo-stocktake-audit.php:13-15

    Recommendation

    Remove the nopriv registration; keep only wp_ajax_ for authenticated admins.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →