Title: HDWebmobile Booking & Appointments Author: HDWebMobile Published: October 13, 2026 Last modified: October 14, 2026 --- Search plugins ![](https://ps.w.org/hdwebmobile-booking-appointments/assets/banner-772x250.png? rev=3743194) ![](https://ps.w.org/hdwebmobile-booking-appointments/assets/icon-256x256.png?rev =3743194) # HDWebmobile Booking & Appointments By [HDWebMobile](https://profiles.wordpress.org/htrxuan/) [Download](https://downloads.wordpress.org/plugin/hdwebmobile-booking-appointments.1.0.0.zip) * [Details](https://wordpress.org/plugins/hdwebmobile-booking-appointments/#description) * [Reviews](https://wordpress.org/plugins/hdwebmobile-booking-appointments/#reviews) * [Installation](https://wordpress.org/plugins/hdwebmobile-booking-appointments/#installation) * [Development](https://wordpress.org/plugins/hdwebmobile-booking-appointments/#developers) [Support](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/) ## Description HDWebmobile Booking & Appointments turns any simple WooCommerce product into a bookable service. Customers pick an available date and time slot on the product page; the booking is confirmed the moment their order completes, and they can view or cancel it later under My Account. #### Security by design A serious class of bug in booking tools is an “update my booking profile” endpoint that accepts a client-supplied field linking the booking record to a WordPress user id, with no check that it still points at the requester’s own account (an IDOR / mass-assignment flaw) — which can let a low-privileged customer reset the password of _any_ WordPress user, including an administrator. This plugin closes that vulnerability class by construction: * A booking’s owner is written in exactly one place — at order completion, from the order’s own customer id — and never again. There is no “update booking” code path anywhere in this plugin that accepts a customer id, user id, or any similar field from a request. * This plugin never touches a WordPress password. There is no code path here that calls `wp_set_password()` or anything like it, at all — a customer’s password remains entirely WordPress core’s own Account Details screen. * A customer can only ever see or cancel their own bookings, scoped by their logged- in account at the database query itself — never by an id taken from the request. * Per-slot capacity is enforced with an atomic, race-condition-safe claim (a database uniqueness constraint), so two customers can never both be confirmed into the same slot beyond its configured capacity. #### Key Features * Turn any simple product into a bookable service from its own Product Data > Booking tab * Configurable available days, time slots, lead time, and how many days ahead to offer * Per-slot capacity — a slot stops being offered once it’s full * Booking is confirmed automatically when the order is marked Completed * A “Bookings” tab under My Account to view and cancel upcoming bookings * If a slot fills up between add-to-cart and checkout, the order still completes normally and the admin is emailed to help reschedule — no booking is ever double- booked #### Limitations (please read before installing) * Simple products only in this version — no variable-product support * No staff/resource assignment — a slot’s capacity is a single shared number, not per-staff-member * No calendar sync (Google Calendar, iCal, etc.) in this version #### Enjoying this plugin? If it helps your site, please consider [leaving an honest review on WordPress.org](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/reviews/#new-post)— it helps other WordPress users find it. Found a problem or have an idea? Please [open a support topic](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/) first so it can be fixed. ### How to Use #### 1. Configure a bookable product On a simple product’s “Booking” tab, check “Bookable service”, set available days, time slots (one per line), lead time, and capacity per slot. #### 2. Customer books On the product page, the customer picks a date and time slot before adding to cart— exactly like any other WooCommerce purchase. #### 3. Booking confirmed Once the order is marked Completed, the booking is confirmed and appears under the customer’s My Account > Bookings, where they can cancel it if needed. ## Screenshots [⌊The "Booking" tab on a product, with availability and capacity settings.⌉⌊The " Booking" tab on a product, with availability and capacity settings.⌉[ The “Booking” tab on a product, with availability and capacity settings. [⌊The date/time picker on a product page.⌉⌊The date/time picker on a product page .⌉[ The date/time picker on a product page. [⌊The Bookings list under WooCommerce > HDWebmobile.⌉⌊The Bookings list under WooCommerce > HDWebmobile.⌉[ The Bookings list under WooCommerce > HDWebmobile. ## Installation 1. Upload the plugin files to the `/wp-content/plugins/hdwebmobile-booking-appointments` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active. 3. Edit a simple product, open its new “Booking” tab under Product Data, and configure availability. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “HDWebmobile Booking & Appointments” is open source software. The following people have contributed to this plugin. Contributors * [ HDWebMobile ](https://profiles.wordpress.org/htrxuan/) [Translate “HDWebmobile Booking & Appointments” into your language.](https://translate.wordpress.org/projects/wp-plugins/hdwebmobile-booking-appointments) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/hdwebmobile-booking-appointments/), check out the [SVN repository](https://plugins.svn.wordpress.org/hdwebmobile-booking-appointments/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hdwebmobile-booking-appointments/) by [RSS](https://plugins.trac.wordpress.org/log/hdwebmobile-booking-appointments/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release: per-product availability and capacity, atomic slot claiming on order completion, “Bookings” My Account tab with cancellation, shortage handling with admin notification. ## Meta * Version **1.0.0** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [appointments](https://wordpress.org/plugins/tags/appointments/)[booking](https://wordpress.org/plugins/tags/booking/) [reservations](https://wordpress.org/plugins/tags/reservations/)[scheduling](https://wordpress.org/plugins/tags/scheduling/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/hdwebmobile-booking-appointments/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/reviews/) ## Contributors * [ HDWebMobile ](https://profiles.wordpress.org/htrxuan/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/hdwebmobile-booking-appointments/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://paypal.me/htrxuan/20)