HDWebmobile Wholesale Pricing

HDWebmobile Wholesale Pricing

Role-based wholesale prices with a gated application form — the wholesale role is only ever granted by an admin approving an application, never by any request.

Overview

HDWebmobile Wholesale Pricing gives your trade customers their own pricing. Set a wholesale price on each product’s Product Data panel, or a single store-wide percentage discount. Logged-in customers who hold the Wholesale Customer role automatically see wholesale prices everywhere — shop, product page, cart and checkout. Everyone else sees your normal retail prices. Customers ask for wholesale access through an application form (on the My Account dashboard, or the [hdws_apply] shortcode), and you review applications on one screen and approve or reject each one.

Wholesale and “lead capture” plugins have repeatedly turned their registration flow into a privilege-escalation hole. “WooCommerce Wholesale Lead Capture” (versions before 2.0.3.2) shipped CVE-2026-27542: an unauthenticated privilege escalation to administrator through the registration/lead flow, because role information was taken from the request. This plugin makes that class of bug impossible by construction. The application form never assigns a role — submitting it only inserts a row with status “pending” for the current logged-in user; the repository’s create_application() method takes the applicant’s user id as its first argument, and the only caller passes get_current_user_id(). No field or method anywhere in the plugin accepts a user id, role, or capability from a request. There is one approval path: the wholesale role is added in exactly one private line of code, reached only through an admin handler that checks manage_woocommerce and a nonce, and reads only an application id. The role itself is harmless by design — Wholesale Customer is registered with the single read capability, a customer-equivalent, so even a mistaken assignment carries no admin power. Pricing is gated on the verified role only, checked server-side via wp_get_current_user() — there is no cookie, query parameter, or form field that turns wholesale pricing on.

Key Features

• Per-product wholesale price, or a store-wide percentage discount as a fallback
• Wholesale prices apply consistently across shop, product, cart and checkout
• Customer application form on My Account and via [hdws_apply]
• One-screen review queue: Approve grants the role, Reject removes it
• The Wholesale Customer role is a plain customer-level role with no admin power

Limitations

Please read before installing:

• One wholesale price per product (or the global percentage) — no per-customer or per-quantity price tiers in this version
• Wholesale pricing follows the account, not a “wholesale mode” toggle
• Approval is manual; there is no automatic approval rule

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-wholesale-pricing directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Set wholesale prices on products (or a store-wide percentage), then review applications as they arrive under WooCommerce > Wholesale Applications.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: per-product/global wholesale pricing, gated application & approval flow, role assignment never taken from a request.)

See our other WordPress plugins for more WooCommerce and site-utility tools.