HDWebmobile Secure Downloads

HDWebmobile Secure Downloads

Let customers recover their WooCommerce download links using their order number and key — no file path is ever read from a request.

Overview

HDWebmobile Secure Downloads gives customers a way to get back to their downloadable products after checkout. Download links appear automatically on the order confirmation page, and a [hdsd_my_downloads] shortcode lets anyone who lost the email or closed the tab look them up again using their order number and order key — no WordPress account required. Every download link shown is exactly the one WooCommerce’s own core already generated for that order; this plugin never builds, guesses, or serves a file itself.

“Direct Download for WooCommerce” (versions up to and including 1.19) shipped CVE-2026-15019 (CWE-22 Path Traversal, CVSS 7.5): its download endpoint read a file path straight from the request and served it, and its “ownership” check only confirmed that some free, virtual, downloadable product existed on the site — not that the specific file being requested belonged to the specific order being claimed. That let an unauthenticated visitor read arbitrary files on the server on any store with at least one qualifying product. This plugin is built so that mistake has nowhere to happen: no file path is ever read from a request anywhere in this plugin — the only values ever taken from a request are an order number and an order key, plain identifiers, never used as a filesystem path. Ownership is checked against the specific order being claimed, the same way WooCommerce’s own core checks guest access to an order: the order id must match AND the supplied key must satisfy hash_equals() against that exact order’s real key. This plugin never reads or streams a file — every download link shown is WC_Order::get_downloadable_items()‘s own pre-built URL, independently re-validated by WooCommerce core itself the moment it’s clicked. Lookups are rate-limited per visitor, and a wrong order number and a wrong key both produce the same generic message.

Key Features

• Download links shown automatically on the order confirmation (“thank you”) page
• A [hdsd_my_downloads] shortcode: customers recover their links later with just their order number and order key, no account needed
• Optional reminder line in order emails pointing at your lookup page
• Every link is WooCommerce’s own, unmodified — expiry and remaining-download limits are respected automatically
• Rate-limited lookups; identical, non-revealing error message for any invalid attempt

Limitations

Please read before installing:

• Does not add downloadable-product functionality — surfaces links to files already configured via WooCommerce’s own downloadable-product feature
• No email-based “resend my link” flow in this version; recovery is via order number + order key lookup only
• The optional email reminder is a plain line of text, not a full resend of the actual links

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-secure-downloads directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Add the [hdsd_my_downloads] shortcode to a page (e.g. a “Recover My Downloads” page) and link to it from your site or emails.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: order confirmation download links, order number + key recovery lookup, rate-limited with non-revealing errors.)

See our other WordPress plugins for more WooCommerce and site-utility tools.