WP Manifestindependent plugin directory
manifest / developer / bookings-helper

Bookings Helper WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

This extension is a WooCommerce Bookings helper which helps you to troubleshoot bookings setup easier by allowing you to quickly export/import product settings.

★ 31stars
518release downloads
≈20active sites
1.0.9latest · 1 year ago

Install

Download bookings-helper.zip From the 1.0.9 release on GitHub, Sep 30, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/woocommerce/bookings-helper/releases/download/1.0.9/bookings-helper.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This extension is a WooCommerce Bookings helper which helps you to troubleshoot bookings setups easier by allowing you to quickly export/import product settings.

All exports will be in zipped JSON file format.

Minimum Version Requirements

  • WordPress 5.6
  • WooCommerce 6.0
  • PHP 7.0

Global Availability Rules

Importing global availability rules will overwrite all the rules. This is because a bookable product test case will depend on these rules. Since this is an overwriting feature, you can first export the global availability rules for safe keeping before you import your test rules. This way you can always import back your original rules.

Bookable Product

You can export any specific bookable product and all of its settings including resources and persons.

If resources are defined, importing the bookable product will generate new resources that will be linked to the specific product you imported.

You can also use wp-cli to import/export bookable products and availability rules. See the example below.

# Export all products
wp bookings-helper export-products --all --dir=/absolute/path/to/directory/

# Export specific products
wp bookings-helper export-products --products="1,2" --dir=/absolute/path/to/directory/

# Export all products with global availability rules
wp bookings-helper export-products --all --with-global-rules

# Import all products
wp bookings-helper import-products --file=/absolute/path/to/file

# Export global availability rules
wp bookings-helper export-global-availability-rules --dir=/absolute/path/to/directory/

# Import global availability rules
wp bookings-helper import-global-availability-rules --file=/absolute/path/to/directory/

# Import all products with global availability rules
wp bookings-helper import-product --file=/absolute/path/to/file --with-global-rules

Usage

Just install the plugin and activate. Then go to "Tools->Bookings Helper".

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.9 latest
Sep 30, 2025 1 year ago
bookings-helper.zip
33
Apr 3, 2025 1 year ago
bookings-helper.zip
15
Dec 7, 2023 2 years ago
bookings-helper.zip
268
Mar 16, 2023 3 years ago
tag only
—
Nov 23, 2022 3 years ago
bookings-helper.zip
63
Sep 26, 2022 4 years ago
tag only
—
Apr 16, 2020 6 years ago
bookings-helper.zip
139
Sep 6, 2017 9 years ago
tag only
—
Jul 6, 2017 9 years ago
tag only
—
Jul 6, 2017 9 years ago
tag only
—

Active-site estimate ≈20 comes from the median of recent superseded releases. Method.

B grade

Security

Bookings Helper 1.0.9 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.9
Findings
1
Worst severity
medium
Content hash
4ae888898ccf47d403d325b0…

Findings

  • medium Import/export request handlers lack capability check (nonce-only gate with generic action names)

    missing_capability

    WC_Bookings_Helper_Import::catch_import_requests and WC_Bookings_Helper_Export::catch_export_requests are hooked to init and execute for any request with ?page=bookings-helper and a valid nonce. There is no current_user_can() check. Nonce actions are generic ('import_product', 'export_product', 'import_globals', 'export_globals') and could collide with nonces exposed by other code to low-privileged users. Import truncates the wc_bookings_availability table, replaces global availability, creates published bookable products/resources and stores imported meta via maybe_unserialize() (PHP object injection surface from the uploaded file). Export streams product, resource and person meta.

    includes/class-wc-bookings-helper-import.php:20-63

    Recommendation

    Add current_user_can( 'manage_options' ) (or manage_woocommerce) checks in both catch_*_requests handlers before processing, use plugin-prefixed nonce actions, and replace maybe_unserialize() on imported meta with a JSON-only data path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.