HDWebmobile Booking & Appointments

HDWebmobile Booking & Appointments

Sell bookable services and appointments through WooCommerce — a booking’s owner is set exactly once, server-side, at purchase and never accepted from any later request.

Overview

HDWebmobile Booking & Appointments turns any simple WooCommerce product into a bookable service. Customers pick an available date and time slot on the product page; the booking is confirmed the moment their order completes, and they can view or cancel it later under My Account.

A competing booking plugin (Amelia) had an authenticated IDOR/mass-assignment vulnerability (CVE-2026-2931, CVSS 8.8): its “update my booking profile” endpoint accepted a client-supplied field linking the booking record to a WordPress user id, with no check that it still pointed at the requester’s own account — letting a low-privileged customer reset the password of any WordPress user, including an administrator. This plugin closes that vulnerability class by construction: a booking’s owner is written in exactly one place — at order completion, from the order’s own customer id — and never again. There is no “update booking” code path anywhere in this plugin that accepts a customer id, user id, or any similar field from a request. This plugin never touches a WordPress password; there is no code path here that calls wp_set_password() or anything like it. A customer can only ever see or cancel their own bookings, scoped by their logged-in account at the database query itself. Per-slot capacity is enforced with an atomic, race-condition-safe claim (a database uniqueness constraint), so two customers can never both be confirmed into the same slot beyond its configured capacity.

Key Features

• Turn any simple product into a bookable service from its own Product Data > Booking tab
• Configurable available days, time slots, lead time, and how many days ahead to offer
• Per-slot capacity — a slot stops being offered once it’s full
• Booking is confirmed automatically when the order is marked Completed
• A “Bookings” tab under My Account to view and cancel upcoming bookings
• If a slot fills up between add-to-cart and checkout, the order still completes normally and the admin is emailed to help reschedule — no booking is ever double-booked

Limitations

Please read before installing:

• Simple products only in this version — no variable-product support
• No staff/resource assignment — a slot’s capacity is a single shared number, not per-staff-member
• No calendar sync (Google Calendar, iCal, etc.) in this version

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-booking-appointments directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Edit any simple product, open the “Booking” tab in Product Data, and set your available days, slots, and capacity.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: bookable simple products, per-slot capacity with atomic claiming, order-completion confirmation, customer-scoped My Account bookings.)

See our other WordPress plugins for more WooCommerce and site-utility tools.