About this plugin
HDWebmobile Booking & Appointments turns any simple WooCommerce product into a bookable service. Customers pick an available date and time slot on the product page; the booking is confirmed the moment their order completes, and they can view or cancel it later under My Account.
Security by design
A serious class of bug in booking tools is an “update my booking profile” endpoint that accepts a client-supplied field linking the booking record to a WordPress user id, with no check that it still points at the requester’s own account (an IDOR / mass-assignment flaw) — which can let a low-privileged customer reset the password of any WordPress user, including an administrator. This plugin closes that vulnerability class by construction:
- A booking’s owner is written in exactly one place — at order completion, from the order’s own customer id — and never again. There is no “update booking” code path anywhere in this plugin that accepts a customer id, user id, or any similar field from a request.
- This plugin never touches a WordPress password. There is no code path here that calls wp_set_password() or anything like it, at all — a customer’s password remains entirely WordPress core’s own Account Details screen.
- A customer can only ever see or cancel their own bookings, scoped by their logged-in account at the database query itself — never by an id taken from the request.
- Per-slot capacity is enforced with an atomic, race-condition-safe claim (a database uniqueness constraint), so two customers can never both be confirmed into the same slot beyond its configured capacity.
Key Features
- Turn any simple product into a bookable service from its own Product Data > Booking tab
- Configurable available days, time slots, lead time, and how many days ahead to offer
- Per-slot capacity — a slot stops being offered once it’s full
- Booking is confirmed automatically when the order is marked Completed
- A “Bookings” tab under My Account to view and cancel upcoming bookings
- If a slot fills up between add-to-cart and checkout, the order still completes normally and the admin is emailed to help reschedule — no booking is ever double-booked
Limitations (please read before installing)
- Simple products only in this version — no variable-product support
- No staff/resource assignment — a slot’s capacity is a single shared number, not per-staff-member
- No calendar sync (Google Calendar, iCal, etc.) in this version
Enjoying this plugin?
org — it helps other WordPress users find it. Found a problem or have an idea? Please open a support topic first so it can be fixed.
How to Use
1. Configure a bookable product
On a simple product’s “Booking” tab, check “Bookable service”, set available days, time slots (one per line), lead time, and capacity per slot.
2. Customer books
On the product page, the customer picks a date and time slot before adding to cart — exactly like any other WooCommerce purchase.
3. Booking confirmed
Once the order is marked Completed, the booking is confirmed and appears under the customer’s My Account > Bookings, where they can cancel it if needed.