WKGB 轻量会员下载 WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

简体中文 | English

A lightweight WordPress plugin for Epay-compatible points recharges, memberships, paid content, and protected downloads.

WKGB Lite Pay intentionally keeps the payment flow simple: users recharge points through an Epay-compatible checkout, then spend those points on memberships or individual resources. It does not require WooCommerce.

Features

• Epay-compatible checkout using the standard MD5-signed submit.php protocol
• Signed asynchronous webhook verification and idempotent payment processing
• Configurable points-to-CNY exchange rate and minimum recharge
• Monthly, annual, and lifetime membership plans
• Paid post sections with [wkgb_protected]...[/wkgb_protected]
• Paid downloads with authorization checks and nonce-protected redirects
• Member center with balance, plans, and recent orders
• Guest-only Login and Register buttons in the assigned header navigation
• Mobile-friendly, high-contrast interface
• Chinese interface by default with a complete English (en_US) translation
• No WooCommerce dependency

Requirements

• WordPress 6.8 or newer
• PHP 8.0 or newer
• HTTPS
• An Epay-compatible gateway that supports submit.php, synchronous returns, asynchronous notifications, and MD5 signatures

Installation

1. Download the latest release ZIP.
2. In WordPress, open Plugins → Add New → Upload Plugin.
3. Upload the ZIP and activate WKGB Lite Membership & Downloads.
4. Open Membership & Downloads → Payment Settings.
5. Enter the HTTPS gateway URL, merchant ID, merchant key, exchange rate, minimum recharge, and membership prices.
6. Copy the displayed webhook URL into the corresponding notification setting at your payment provider if required.

The plugin creates a Member Center page automatically. WordPress sites using en_US display the English interface; Chinese sites retain the Chinese interface.

Usage

Protect part of a post

[wkgb_protected]
This content is visible after purchase or to active members.
[/wkgb_protected]

Set the post price in the Paid Content & Downloads meta box.

Sell a download

Set both a points price and a download URL in the post meta box. The public URL is never rendered as the purchase button. Authorized users receive a nonce-protected redirect through WordPress.

Shortcodes

• [wkgb_account] — complete member center
• [wkgb_recharge] — points recharge form
• [wkgb_membership] — membership plans
• [wkgb_protected]...[/wkgb_protected] — protected post section
• [wkgb_download] — download box for the current post
• [wkgb_download id="123"] — download box for a specified post

Payment flow

1. A signed-in user creates a pending recharge order.
2. The browser submits a signed form directly to the configured Epay checkout.
3. The asynchronous webhook is verified against the merchant ID, signature, order number, amount, and payment status.
4. A database transaction marks the order paid and credits points exactly once.
5. Membership and content purchases spend points in a separate database transaction.

Reverse proxies and caches

Do not cache these paths:

• /member-center/
• /wkgb-pay/notify/
• /wkgb-pay/return/
• /wp-admin/admin-post.php

Your firewall or CDN must allow unauthenticated payment notifications to /wkgb-pay/notify/. The plugin still rejects invalid or unsigned requests.

Security notes

• The merchant key is never rendered back into the settings page.
• Recharge actions require a signed-in user, a WordPress nonce, and rate limiting.
• Webhooks use constant-time signature comparison and exact order checks.
• Completed orders are idempotent and cannot credit the same recharge twice.
• Download access is checked on every request.

Review the code and test with a low-value transaction before using it in production. Payment regulations and gateway behavior vary by country and provider.

Data and uninstall behavior

Deactivating or deleting the plugin does not automatically remove wallets, orders, ledger entries, settings, or post pricing metadata. This is intentional to prevent accidental financial-record loss.

Contributing and security

Bug reports and pull requests are welcome. See CONTRIBUTING.md. For vulnerabilities, follow SECURITY.md and do not publish secrets or exploit details in a public issue.

License

GPL-2.0-or-later. See LICENSE.