HDWebmobile Formula Pricing

Price a product from customer-entered numbers using a formula -- evaluated safely, never with PHP's eval().

• WordPress.org: https://wordpress.org/plugins/hdwebmobile-formula-pricing/
• Requires: WordPress 6.9+, WooCommerce, PHP 7.4+
• License: GPLv2 or later

Description

HDWebmobile Formula Pricing lets customers enter measurements or quantities on the product page, and prices the product live from a formula you write using those field names (e.g. 10 + width * height * 0.05 for a custom-cut material priced by area). This is a common real need for stores selling custom-sized fabric, framed prints, engraved items, or anything priced by dimension or quantity, not just a flat number.

Why this plugin exists

A competing "Custom Product Addons Pro" plugin implemented formula-based pricing by passing the merchant's formula text straight into PHP's eval() at calculation time (CVE-2026-4001) -- an unauthenticated remote code execution vulnerability. This plugin closes that entire vulnerability class by construction:

• The formula is tokenized character-by-character into a strict set of allowed pieces: numbers, your own configured field names, and the four arithmetic operators plus parentheses. Anything else in the formula text -- any other letter sequence, any function-call-looking pattern, any special character -- causes the formula to be rejected outright when you save it.