WP Manifestindependent plugin directory
manifest / ecommerce / donations-for-woocommerce-companion

Donations for WooCommerce Companion WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Companion plugin adding interval-first recurring donation support to Donation for WooCommerce. v0.7.0 in development — templates + bulk apply landing soon. Stable: v0.6.6.

★ 0stars
29release downloads
v2.5.0latest · 6mo ago

Install

Download donations-for-woocommerce-companion.zip From the v2.5.0 release on GitHub, May 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/trinity-tech-strategies/donations-for-woocommerce-companion/releases/download/v2.5.0/donations-for-woocommerce-companion.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

The modern donor-facing form pattern — three side-by-side options for One-time, Monthly, and Annually with separate preset amount tiers per interval — built on top of the Donation for WooCommerce parent plugin without modifying it.

┌───────────────────────────────────────────────────────────────┐
│  ○ One-time      ● Monthly       ○ Annually                   │
│ ─────────────────────────────────────────────────────────     │
│  ○ $10           ○ $25 [Most popular]  ○ $50                  │
│       ○ Custom: $ ___________                                 │
│                                                               │
│  Provides school supplies for one student                     │
│                                                               │
│        [ Donate $25/month ]                                   │
└───────────────────────────────────────────────────────────────┘

The companion plugin feeds the parent plugin's existing AJAX pipeline with the right parameters, so all downstream wiring (cart, order, subscription, emails, reports, PDF receipts) keeps working untouched. Recurring billing is handled by either WooCommerce Subscriptions (paid) or Subscriptions for WooCommerce by WPS (free) — auto-detected.


Why this exists

Donation for WooCommerce supports recurring donations technically, but only via a single legacy "Make this recurring" checkbox plus period/interval/length dropdowns. There's no built-in way to offer the modern donor pattern that nonprofits like Charity:Water, NPR, and Wikipedia have made standard. This companion adds it without forking the parent plugin — the parent keeps receiving auto-updates; the companion attaches to its 47+ documented action and filter hooks.


What's in v1.1.0

Feature Details
Interval-first donor form Side-by-side tabs with per-interval presets, min/max custom amounts, and CTA templating
Layered config model Defaults → Global Settings → Named Templates → Campaign Overrides. Save once, apply to many.
Per-currency presets "$25 / £20 / €22" — admins define amounts per currency; resolves at render time via WCML (or filter for WCPay/Aelia)
Advanced cadences (opt-in) Weekly, quarterly, semi-annually, plus admin-defined custom ("every 6 weeks")
Donor impact messaging Per-preset impact labels with four display modes, featured-preset badges, subtitles, annual-equivalency text
Live admin preview pane Pixel-faithful donor-form preview on the campaign edit screen, Templates page, and Settings page
Donor-facing campaign directory Six taxonomies, filterable grid via shortcode + Gutenberg block + Elementor widget, REST live search
Event hooks Six WordPress action hooks for analytics / CRM / webhook integrations (GA4, FluentCRM, Zapier recipes shipped)
WPML + WCML support All admin-defined strings registered with WPML; taxonomies translate per-term; per-currency presets resolve via WCML
wp dfwc-companion health CLI Diagnostic report in JSON / table / markdown — pipe into monitoring agents
Diagnostics admin page 13 health checks with status pills, suggested remediations, copy-paste-ready support report

Full changelog: readme.txt. Per-release notes: .release-notes.md.


Requirements

Component Minimum
WordPress 6.2
PHP 7.4
WooCommerce 5.0
Donation for WooCommerce (parent) 3.9.8
Subscription engine WC Subscriptions OR Subscriptions for WooCommerce (WPS, free) — either works

The companion is HPOS-compatible (High-Performance Order Storage) and Cart/Checkout-Block-compatible.


Install

From a release zip (recommended)

  1. Download the latest zip from the Releases page.
  2. WordPress admin → Plugins → Add New → Upload Plugin → activate.
  3. Visit WooCommerce → Donations Companion → Diagnostics to verify the install.

From source

git clone https://github.com/f8l124/donations-for-woocommerce-companion.git
cd donations-for-woocommerce-companion
composer install     # dev tooling only — runtime ships without vendor/
npm install          # Playwright + wp-env

Then symlink or copy the directory into your site's wp-content/plugins/.

Once it's available on WordPress.org

Plugins → Add New → search for "Donations for WooCommerce Companion" (planned post-v1.1.0).


Usage in 60 seconds

  1. Edit a campaign → fill in the "Interval-First Donation Form" meta box: enable the intervals you want, set preset amounts, set min/max for custom amounts.
  2. Place the form wherever donors should see it — three options:
    • Auto-augment: the companion automatically wraps parent's existing form rendering on campaign permalinks, the parent's [wc_woo_donation] shortcode, and the parent's widget. No further action needed.
    • Shortcode: [dfwc_recurring_donation campaign_id="123"]
    • Gutenberg block: search for "Recurring Donation" in the inserter
  3. Test the donor flow in the live admin preview pane below the meta box. Toggle viewport / engine / language / currency to verify how the form behaves under each.

For multi-campaign sites, define a template once at Donations Companion → Templates, then apply via the campaign meta box or via bulk actions on the campaign list screen.

Full walkthrough: docs/getting-started.md.


Documentation

For nonprofit admins

For developers

For maintainers


Architecture

The plugin is small (~5,000 LOC PHP+JS+CSS, well under the wp.org soft limit) and intentionally low-magic:

  • Hand-rolled PSR-4-ish autoloader — no Composer in the runtime. Composer is dev-only.
  • No custom database tables — all per-campaign config in post meta on wc-donation posts; templates in a single wp_options row.
  • All persistence via update_post_meta / WP_Query — zero direct SQL outside $wpdb->prepare (in uninstall.php for the transient sweep).
  • No remote runtime fetches — no analytics, no telemetry, no external dependencies at runtime.
  • Auto-augmentation, not replacement — the donor sees parent's full form (cause selector, gift aid, processing fee, tributes, donor wall) with our interval-first UI mounted into parent's amount-block position via CSS / JS.
  • Defense in depth on submit — three layers (server-side guard, JS short-circuit, disabled HTML) prevent preview HTML from ever submitting a real donation.

Full architectural overview: docs/architecture/current-state.md.


Testing

Layer Coverage
PHPCS (WPCS + PHPCompatibilityWP) Clean
PHPStan (level 5) No errors
PHPUnit 201 tests / 518 assertions
Parent contract watcher 16 file/line ranges hashed; CI fails if parent restructures
Playwright E2E 10 specs across none / wps / wcs engine fixtures
Plugin Check Gated on DFWC_PARENT_ZIP_URL secret (parent plugin is paid)

Run all gates locally:

composer check            # PHPCS + PHPStan + PHPUnit
composer test:contract    # parent-contract watcher
npm run test:e2e          # Playwright (requires tests/donation-for-woocommerce.zip)

Compatibility & status

This is a community-maintained companion. The parent plugin (Donation for WooCommerce by WPExperts) is not affiliated — the companion attaches via documented hooks rather than forking. A built-in self-check probe runs on every admin page load and surfaces an admin notice if any parent plugin update breaks a contract the companion depends on. A weekly CI watcher catches parent updates the moment they ship.

WPML compatibility certification is planned for post-WordPress.org acceptance — see plans/v2/AA-wpml-integration.md (gitignored locally; spec lives there).


Contributing

Bug reports, feature requests, and pull requests welcome. See:


License

GPL-2.0-or-later — same as the parent plugin and WordPress core. Compatible with the WordPress.org plugin directory's licensing requirements.

Copyright (c) 2026 David Stells.

Releases

Newest 25 of 31 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.5.0 latest
May 3, 2026 6mo ago
donations-for-woocommerce-companion.zip
5
May 3, 2026 6mo ago
donations-for-woocommerce-companion.zip
1
May 2, 2026 6mo ago
donations-for-woocommerce-companion.zip
5
May 1, 2026 6mo ago
donations-for-woocommerce-companion.zip
4
May 1, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
May 1, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
May 1, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 30, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
Apr 30, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
Apr 30, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
Apr 30, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 30, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 29, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 28, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 28, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 28, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 28, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
Apr 28, 2026 6mo ago
donations-for-woocommerce-companion.zip
2
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
Apr 27, 2026 6mo ago
donations-for-woocommerce-companion.zip
0
All releases on GitHub →
A- grade

Security

Donations for WooCommerce Companion 2.5.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
2.5.0
Findings
1
Worst severity
low
Content hash
5e729bb3013fbf85412d0e75…

Findings

  • low Unauthenticated creation of on-hold WooCommerce orders via crypto-pending-order endpoint

    unnecessary_attack_surface

    The /wp-json/dfwc-companion/v1/crypto-pending-order route is registered with permission_callback __return_true and, when crypto donations are enabled and the TGB Token_Store is configured, lets any unauthenticated client create an on-hold WooCommerce donation order by POSTing a donation_id, campaign_id and amount_usd. It is feature-gated (404 when disabled), rate-limited to 10 requests/IP/minute, input-validated and idempotent by donation_id. The order can only ever move to completed/paid through the separate /tgb-webhook handler, which enforces an HMAC-SHA256 signature (hash_equals) against the stored TGB webhook secret, so a forged pending order stays on-hold forever. The residual impact is therefore limited to phantom on-hold orders (admin order-list noise and possible slow resource growth), not payment spoofing.

    includes/REST/Crypto_Pending_Order_REST_Controller.php:51-97

    Recommendation

    Bind pending-order creation to a short-lived nonce or signed token issued with the donation widget page, and auto-expire/garbage-collect on-hold donation orders that never receive a matching verified webhook within a timeout.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.