HDWebmobile License Key Delivery

HDWebmobile License Key Delivery

Sell software license keys through WooCommerce — keys are pasted or generated in wp-admin, never imported from an uploaded file.

Overview

HDWebmobile License Key Delivery turns any simple WooCommerce product into a license-key product. Add a pool of keys under the product’s own “License Keys” tab — paste them in or generate them randomly — and one is automatically assigned to each customer the moment their order is completed.

A competing WooCommerce license-key plugin had an Unrestricted File Upload vulnerability (CVE-2026-28114, CVSS 9.1): a Shop Manager-level account — a role routinely handed to shop staff and third-party agencies, and deliberately less trusted than Administrator — could bulk-import license keys through a file upload with insufficient extension/MIME/content validation, letting a disguised .php file achieve remote code execution. This plugin closes that vulnerability class by construction, not mitigation: there is no file upload anywhere in this plugin. Bulk-adding keys is paste-a-textarea or generate-server-side only — the vulnerable code path simply does not exist here. Keys you paste in are stored exactly as given (with a database-level uniqueness constraint so the same key can never be issued twice); keys the plugin generates for you use PHP’s own cryptographically secure random_bytes(), never anything predictable. The key handed to each customer is claimed with a single atomic database update, so two orders completing at the same instant can never be issued the same key. A customer’s “License Keys” page under My Account is scoped to their own account at the database query itself — one customer can never see another’s keys.

Key Features

• Turn any simple product into a license-key product from its own Product Data tab
• Paste existing keys (one per line) or generate random ones on the spot
• One key delivered automatically per unit purchased when the order is marked Completed
• Delivered keys show on the order confirmation page, in order emails, and on the admin order screen
• A “License Keys” tab under My Account lists everything a customer has purchased
• If stock runs out, the order still completes normally and the admin is emailed to restock — no fake or duplicate key is ever issued

Limitations

Please read before installing:

• No file-upload bulk import — paste or generate only, by design (see Overview)
• Simple products only in this version — no variable-product support
• No per-key activation limits or remote deactivation; a key is either unassigned or assigned

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-license-key-delivery directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Edit any simple product, open the “License Keys” tab in Product Data, and paste in or generate your keys.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: paste-or-generate license key delivery for simple products, atomic per-order key assignment, customer-scoped My Account keys page.)

See our other WordPress plugins for more WooCommerce and site-utility tools.