HDWebmobile Vendor Marketplace
Turn your store into a multi-vendor marketplace. Vendors can only ever touch their own products, orders, and earnings.
Overview
HDWebmobile Vendor Marketplace lets independent sellers apply, get approved, and sell their own products through your WooCommerce store. Each vendor gets a dashboard to manage their products, see their own order items, track their earnings, and request a withdrawal — all scoped strictly to their own account.
A competing multi-vendor marketplace plugin (Dokan) disclosed a cluster of related authorization vulnerabilities in 2026: CVE-2026-11987 let a subscriber-level account read other vendors’ unpublished product data via IDOR; CVE-2026-16564 let a vendor account change the status of any order on the marketplace, including other vendors’ and the store’s own, because a bulk order-status REST endpoint never verified ownership; and CVE-2026-16577 let a vendor manipulate their own withdrawal amount because the client-supplied payment figure was never validated against their real balance. This plugin closes all three vulnerability classes by construction, not by bolted-on checks: product ownership is never enforced by this plugin’s own code at all — WooCommerce registers the “product” post type with capability_type => 'product' and map_meta_cap => true, so WordPress core’s own decades-tested authorization system already refuses to let one vendor edit, delete, or view another vendor’s product. A vendor can never change a WooCommerce order’s own status — there is no code path anywhere in this plugin that lets vendor-facing code call $order->set_status(). Vendors can only mark their own order line item as shipped, and every such request explicitly verifies the product behind that line item is actually authored by the vendor making the request. A withdrawal request never accepts an amount from the vendor — the payable amount is always computed server-side, fresh, as the sum of that vendor’s own available earnings ledger rows.
Key Features
- Front-end “Become a Vendor” application form; admin approval is the only way to actually grant vendor access
- Approved vendors get their own product-management screens (using WooCommerce’s own Products screen, automatically scoped to their own listings)
- A per-vendor commission rate, set once by the store admin
- Automatic per-line-item earnings split the moment an order is marked Completed
- A vendor dashboard: earnings balance, recent earnings, order items, and a “Request Withdrawal” button
- A public storefront view per vendor, reusing your theme’s own Shop page layout
- A “Sold by” line on product pages linking to that vendor’s storefront
Limitations
Please read before installing:
- No built-in payment gateway integration for payouts — withdrawal requests are approved and marked paid manually by the store admin; actually transferring funds is outside this plugin’s scope
- One flat commission rate for the whole marketplace — no per-vendor or per-category rates in this version
- No vendor-to-vendor messaging or vendor-branded email templates in this version
Quick Setup
- Upload the plugin files to the /wp-content/plugins/hdwebmobile-vendor-marketplace directory, or install through the Plugins screen directly.
- Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
- Set your marketplace commission rate, then review and approve vendor applications as they come in.
Latest Version
Current stable version in readme: 1.0.0 (Initial release: vendor application & approval, scoped product management, per-line-item earnings split, vendor withdrawal requests, public vendor storefronts.)
See our other WordPress plugins for more WooCommerce and site-utility tools.