HDWebmobile Recent Sales Notifications
A recent-purchase popup — returns only pre-aggregated, non-identifying data, never a raw customer record.
Overview
HDWebmobile Recent Sales Notifications shows a small popup cycling through your recent real orders — “Someone bought {Product} 2 hours ago”. It’s built from your store’s own completed and processing orders, with no setup beyond turning it on.
“Live sales notification for WooCommerce” (versions up to and including 2.3.39) shipped CVE-2025-12955 (CWE-862 Missing Authorization): its getOrders function had no authorization check at all, so any unauthenticated visitor could call it directly and extract sensitive customer information. This plugin closes that entire class of bug by construction — not by adding a check to an endpoint, but by having no endpoint at all. Nothing is ever fetched live: the notification list is computed once, server-side, on page render, and handed to a small script as a fixed, already-safe payload. Only two, deliberately narrow, fields ever leave the order — a public product name (and its own public page URL) and a relative time (“2 hours ago”). No customer name, email, address, order id, or order total is ever read out of the order object. Location is off by default, and coarse even when enabled — an admin can opt in to a two-letter country code, never a city, region, or address. The popup script only ever writes plain text; it never uses innerHTML and never fetches anything itself.
Key Features
- A small, unobtrusive “Someone just bought…” popup cycling through recent orders
- Configurable look-back window, display duration, and interval between notifications
- Optional (off by default) approximate country — never anything more precise
- No custom database table; results are cached briefly so nothing hits the database on every page view
- Bottom-left or bottom-right placement
Limitations
Please read before installing:
- Shows only the first product from each order, not every item
- No per-product opt-out of appearing in notifications in this version
- No admin preview beyond viewing the live storefront
Quick Setup
- Upload the plugin files to the /wp-content/plugins/hdwebmobile-recent-sales-notifications directory, or install through the Plugins screen directly.
- Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
- Go to WooCommerce > Recent Sales Notifications to set the look-back window and placement, then turn it on.
Latest Version
Current stable version in readme: 1.0.0 (Initial release: server-rendered recent-sale popups, no AJAX/REST endpoint, no customer-identifying data ever exposed.)
See our other WordPress plugins for more WooCommerce and site-utility tools.