HDWebmobile Post-Purchase Upsell
A one-click upsell on the order-received page — the original order is always verified by its real key, the price always computed server-side.
Overview
HDWebmobile Post-Purchase Upsell shows one extra product, at a discount, on the order-received page right after checkout. Accepting it creates a brand new, separate order for just that item, with its own payment link — nothing is added to or recharged on the original order.
A competing post-purchase upsell plugin’s “accept this upsell” endpoint took the original order id straight from the request and trusted it to determine whose order (and billing/shipping address) the upsell attached to, without ever verifying the requester actually owned that order (CWE-639, Authorization Bypass Through User-Controlled Key — an IDOR). Anyone able to guess or increment an order id could attach an upsell order to a stranger’s order, and in doing so read back that stranger’s billing and shipping address. This plugin resolves the original order exactly the way WooCommerce’s own guest-order lookup does: the original order is only ever accepted when both its real id AND its real order key match, via a constant-time comparison — the same check WooCommerce’s own checkout page already performs before this plugin’s offer is even shown. The offer’s price is always computed fresh from the upsell product’s own regular price and the configured discount — never a value carried on the accept request. Accepting is idempotent: a retried or double-submitted accept can never create a second upsell order for the same purchase.
Key Features
- One admin-configured upsell offer shown right after checkout
- Accepting creates a genuinely separate order, pre-filled with the same billing details, ready to pay
- Works for guests and logged-in customers alike
Limitations
Please read before installing:
- One global offer, not per-product upselling
- No automatic payment/recharge — the customer completes a normal (short) checkout for the new order
Quick Setup
- Upload the plugin files to the /wp-content/plugins/hdwebmobile-post-purchase-upsell directory, or install through the Plugins screen directly.
- Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
- Go to WooCommerce > HDWebmobile > Post-Purchase Upsell to choose a product and discount.
Latest Version
Current stable version in readme: 1.0.0 (Initial release: a one-click post-purchase upsell, with the original order always re-verified by its real key and the price always computed server-side.)
See our other WordPress plugins for more WooCommerce and site-utility tools.