WP Manifestindependent plugin directory
manifest / ecommerce / wc-loyalty-card-system

WooCommerce Loyalty Card System WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

A complete loyalty program plugin for WooCommerce — featuring points earning, tiered memberships, physical-style loyalty cards, and gift cards, all integrated directly into the WooCommerce checkout and My Account pages.

★ 1stars
9release downloads
≈10active sites
v1.2.0latest · 7mo ago

Install

Download wc-loyalty-card-system.zip From the v1.2.0 release on GitHub, Feb 27, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/towfique-elahe/wc-loyalty-card-system/releases/download/v1.2.0/wc-loyalty-card-system.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A complete loyalty program plugin for WooCommerce — featuring points earning, tiered memberships, physical-style loyalty cards, and gift cards, all integrated directly into the WooCommerce checkout and My Account pages.


Requirements

Requirement Minimum Version
WordPress 5.0
PHP 7.2
WooCommerce 4.0
MySQL 5.6

Features

Loyalty Points

  • Customers automatically earn points when an order is marked Completed
  • Dual earning rate: 1 point per 100 TK + 5 bonus points per 450 TK spent
  • Fixed point value: 1 point = 1 TK discount
  • Configurable minimum points required before redemption
  • Configurable point expiry in days (set to 0 for no expiry)
  • Full points history tracked per user
  • Points applied as an optional discount at checkout — customers enter how many points to use, and the discount is deducted from the order total before payment

Tiered Membership

  • Users are automatically placed into tiers based on their lifetime points
  • Four default tiers (fully customizable):
Tier Points Required Discount
Bronze 0 – 499 0%
Silver 500 – 1,999 5%
Gold 2,000 – 4,999 10%
Platinum 5,000+ 15%
  • Admin can add, edit, or remove tiers, set custom colors, and preview badges live in the admin panel
  • Tier discount auto-applied to cart at checkout

Loyalty Cards

Three distinct physical-style card types, each with a unique card number, validity period (1 year), and discount rate:

Card Issuance Default Discount
Privilege Card (PC…) Customer purchase or free on qualifying order 10%
Investor Card (IC…) Admin-issued only 20%
Platinum Card (PLC…) Admin-issued only 20%
  • Privilege card can be purchased (configurable price, default: 500 TK)
  • Privilege card is automatically awarded free when an order meets the threshold (default: 2,000 TK)
  • The customer's best active card discount is auto-applied at checkout
  • Admin can update card status (Active / Inactive / Expired) from the Loyalty Cards admin page
  • Admin can manually issue Investor or Platinum cards to any user

Gift Cards

  • Admin can create gift cards with any custom amount
  • Default card denominations: 500, 1,000, 2,000, and 5,000 TK
  • Unique auto-generated card numbers
  • Track initial amount, current balance, status, and optional expiry date
  • Applied as an optional discount at checkout — customers enter their gift card code and the balance is deducted from the order total
  • Admin can delete cards from the admin panel

My Account Integration

Three custom endpoints added to the WooCommerce My Account area:

  • /loyalty-points — points balance, tier status, and full transaction history
  • /loyalty-cards — all issued loyalty cards with details
  • /gift-cards — gift card balances

A loyalty dashboard widget is also shown on the main My Account dashboard, displaying current points balance, tier, and tier discount.

Admin Reports

Filterable by custom date range. Reports include:

  • Total points earned and redeemed in the period
  • Points redemption rate (%)
  • New gift cards issued
  • New loyalty cards issued
  • Points distribution breakdown by tier (users per tier, total & average points)
  • Daily points activity table (earned vs redeemed per day)

HPOS Compatible

Fully compatible with WooCommerce High Performance Order Storage (HPOS) — declared via FeaturesUtil::declare_compatibility().


Admin Pages

The plugin adds a Loyalty System top-level menu in the WordPress admin with six sub-pages:

Page Description
Dashboard Overview stats + recent transactions
Points Settings Earning rates, minimum redemption, expiry
Gift Cards Create, view, and delete gift cards
Loyalty Cards View all cards, update status, issue special cards
Tiers Configure tier thresholds, discounts, and colors
Reports Date-range filtered loyalty analytics

Database Tables

The plugin creates 7 custom tables on activation (prefixed with your WordPress table prefix):

Table Purpose
loyalty_points User points balance and lifetime points
points_transactions Full earn/redeem transaction log
gift_cards Gift card records (number, balance, status, expiry)
gift_card_transactions Gift card usage per order
loyalty_cards Issued loyalty cards (type, discount, validity)
card_purchases Record of card purchases linked to orders
loyalty_tiers Tier configuration (name, points range, discount)

Tables are automatically verified and recreated if missing on each plugin load (checked once per day via transient).


Installation

  1. Upload the wc-loyalty-card-system folder to /wp-content/plugins/
  2. Make sure WooCommerce is installed and activated — the plugin will not activate without it
  3. Activate the plugin through Plugins > Installed Plugins
  4. Navigate to Loyalty System > Dashboard to get started

Note: WooCommerce must be active before activating this plugin. Attempting to activate without WooCommerce will show an error and automatically deactivate the plugin.


Configuration

Points Settings

Go to Loyalty System > Points Settings:

  • Set how many points are earned per 100 TK
  • Set bonus points earned per 450 TK
  • Set minimum points required for redemption
  • Set point expiry in days (0 = never expires)

Loyalty Cards

Go to Loyalty System > Loyalty Cards to:

  • View all issued cards
  • Update card status
  • Set Privilege Card price and free-card order threshold (via Points Settings)
  • Issue Investor or Platinum cards manually to any user

Tiers

Go to Loyalty System > Tiers to:

  • Add, edit, or remove tiers
  • Set point thresholds, discount percentages, and display colors
  • Preview tier badges in real-time before saving

File Structure

wc-loyalty-card-system/
├── wc-loyalty-card-system.php       # Main plugin file, bootstrap
├── admin/
│   ├── admin-menu.php               # Admin menu registration & page callbacks
│   ├── admin-ajax-handlers.php      # AJAX action handlers
│   ├── css/
│   │   └── admin-style.css
│   ├── js/
│   │   └── admin-script.js
│   └── partials/
│       ├── dashboard.php
│       ├── points-settings.php
│       ├── gift-cards.php
│       ├── loyalty-cards.php
│       ├── tiers.php
│       └── reports.php
├── includes/
│   ├── class-database.php           # DB query abstraction layer
│   ├── class-loyalty-points.php     # Points earning, redemption, history
│   ├── class-gift-cards.php         # Gift card creation and validation
│   ├── class-privilege-cards.php    # Loyalty card issuance and discount logic
│   ├── class-tier-management.php    # Tier assignment and benefits summary
│   ├── class-admin-settings.php     # Settings registration
│   ├── class-frontend-display.php   # Frontend shortcodes / display
│   └── gateways/
│       ├── class-points-gateway.php # Points redemption payment gateway
│       └── class-gift-card-gateway.php # Gift card payment gateway
├── public/
│   ├── css/
│   │   └── loyalty-system.css
│   ├── js/
│   │   └── loyalty-system.js
│   └── templates/
│       └── loyalty-points.php       # My Account points page template
├── db/
│   └── schema.php                   # Table creation via dbDelta
└── languages/                       # Translation-ready (.pot files)

Developer Notes

  • The main class WC_Loyalty_Card_System uses a singleton pattern (get_instance())
  • All DB operations go through Loyalty_DB (class-database.php) — never raw $wpdb calls in business logic
  • The plugin is translation-ready — text domain: wc-loyalty-system
  • Admin scripts are only enqueued on pages with wcls in the hook name
  • The plugin declares WooCommerce HPOS compatibility via before_woocommerce_init

Author

Towfique Elahe towfiqueelahe.com


License

GPL v2 or later — see https://www.gnu.org/licenses/gpl-2.0.html


Changelog

1.2.0 — 2026-02-27

Fixed

  • Duplicate card issuance bug. A single user could receive the same card type multiple times — e.g. Platinum issued twice by admin, or Privilege Card awarded again automatically even if one already existed. Added has_card_type() guards at the top of purchase_card(), issue_special_card(), and award_free_card(). issue_special_card() now returns a descriptive WP_Error which is shown in the admin UI instead of a generic failure message.
  • Floating widget not toggling. A CSS hover rule (.wcls-floating-widget:hover .wcls-widget-content { display: block }) was conflicting with the JS click toggle, causing the panel to reappear immediately after closing. Removed the hover rule; toggle is now purely JS-controlled.
  • Floating widget positioned on wrong side. Widget was anchored to the right side of the screen. Corrected to left: 20px.
  • Tier pill displaying as plain text in floating widget. A stray wcls-tier-pill text node had been inserted inside the @keyframes wcls-popIn block, invalidating the entire `

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.0 latest
Feb 27, 2026 7mo ago
wc-loyalty-card-system.zip
3
Feb 26, 2026 7mo ago
wc-loyalty-card-system.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

WooCommerce Loyalty Card System 1.2.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.2.0
Findings
1
Worst severity
high
Content hash
92a6f2d468b959731c5fc7e7…

Findings

  • high Predictable gift-card numbers with unauthenticated balance oracle

    predictable_token

    Gift_Cards::generate_card_number() builds codes as 'GC' + unix time() + mt_rand(1000, 9999) (~13 bits of randomness per issuance second) and is not a CSPRNG. wp_ajax_nopriv_check_gift_card_balance is reachable by anyone: frontend scripts are enqueued on all pages with wp_create_nonce('wcls_nonce') even for uid 0, and the handler returns distinct messages for invalid, inactive, expired, zero-balance, and live balance (wc_price). That is an unauthenticated, unthrottled oracle. Any logged-in customer can then attach a discovered number via wcls_apply_gift_card_checkout (no ownership check; gift cards are bearer instruments). An attacker who already holds one issued card learns the timestamp window and can brute-force sibling cards created in the same second or batch (9000 guesses per second of issuance). Combined with the checkout redemption bug, a guessed card can be spent more than once.

    includes/class-gift-cards.php:8-26

    Recommendation

    Generate card numbers with wp_generate_password() / random_bytes() (long, mixed-case, no timestamp). Rate-limit and captcha the balance-check endpoint; do not distinguish unknown vs expired vs empty if the caller should not already possess the code. Consider requiring the purchaser's account (or a second factor) to redeem rather than treating the number as a fully public bearer token.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.