Description

Maréva Bangladesh SMS & OTP connects WordPress and WooCommerce to an SMS provider selected and configured by the site administrator.

Features include:

WooCommerce customer and administrator order notifications.
Payment, order-status and optional stock alerts.
OTP request and verification shortcode.
GreenWeb / BD Bulk SMS, Alpha SMS (sms.bd), and MiMSMS gateway adapters.
Configurable custom HTTPS API adapter.
Primary and fallback gateways.
Editable SMS templates and local delivery logs.
Optional WP-Cron background sending.
Bangladesh phone-number normalization.
WooCommerce HPOS compatibility.
Optional Tutor LMS, LearnDash, LearnPress, MasterStudy LMS, LifterLMS and Academy LMS adapters.

OTP shortcode:

[mareva_sms_otp purpose="verification"]

The plugin is independently developed by Ashikul Islam. It is not affiliated with or endorsed by WooCommerce, GreenWeb, Alpha SMS, MiMSMS, or any supported LMS provider.

External services

This plugin can connect to external SMS delivery services. No SMS provider request is made merely by activating the plugin. A site administrator must configure and enable a gateway, and an SMS-producing action must then occur.

For an enabled gateway, the plugin sends the recipient mobile number, SMS message, configured sender ID, and the authentication values required by that provider. Data is sent when an administrator sends a test SMS, an enabled WooCommerce or LMS event occurs, or a visitor requests an OTP through the shortcode. Provider responses are stored in the site’s WordPress database after known credential fields are redacted.

GreenWeb / BD Bulk SMS

GreenWeb is used to deliver SMS messages selected or generated by the plugin.

Data sent: recipient mobile number, message content, and the API token configured by the administrator.
Sent when: a test SMS, enabled WooCommerce/LMS notification, or OTP request is triggered.
Service website: https://www.greenweb.com.bd/
Terms of service: https://www.greenweb.com.bd/terms-and-conditions.php
Privacy policy: https://www.greenweb.com.bd/privacy-policy.php

Alpha SMS (sms.bd)

Alpha SMS is used to deliver SMS messages selected or generated by the plugin. Alpha SMS is a service of Alpha Net.

Data sent: recipient mobile number, message content, API key, and sender ID when configured by the administrator.
Sent when: a test SMS, enabled WooCommerce/LMS notification, or OTP request is triggered.
Service website: https://sms.bd/
API documentation: https://sms.bd/api
Terms and conditions: https://sms.bd/Terms_Condition/
Privacy information: https://www.alpha.net.bd/AUP/

MiMSMS

MiMSMS is used to deliver SMS messages selected or generated by the plugin.

Data sent: recipient mobile number, message content, sender name, username, and API key configured by the administrator.
Sent when: a test SMS, enabled WooCommerce/LMS notification, or OTP request is triggered.
Service website: https://www.mimsms.com/
Terms of service: https://www.mimsms.com/terms-of-service
Privacy policy: https://www.mimsms.com/privacy-policy

Custom HTTPS API

The administrator may configure an HTTPS endpoint operated by another SMS provider. This feature is not enabled by default.

Data sent: fields mapped by the administrator, normally the recipient mobile number, message content, sender ID, and API credential.
Sent when: the custom gateway is enabled and a test SMS, enabled WooCommerce/LMS notification, or OTP request is triggered.
Terms and privacy: these are determined by the endpoint chosen by the administrator. Before enabling it, the administrator must review that provider’s terms and privacy policy and disclose the provider in the site’s own privacy policy.

The plugin does not include analytics, advertising, telemetry, tracking, remote licensing, or remote command execution.

Privacy

The plugin stores recipient numbers, SMS content, gateway names, delivery status, and provider responses in local WordPress database tables. OTP codes are stored as password hashes and expire after the configured validity period.

Site owners should disclose their enabled SMS provider and message processing in their own privacy policy and obtain any consent required by applicable law.

Plugin data is retained after deactivation and uninstall by default to prevent accidental loss. To remove all plugin data during uninstall, define MARVBASM_REMOVE_DATA_ON_UNINSTALL as true before uninstalling.

Source code and build process

All PHP, JavaScript, and CSS distributed with this plugin is included in human-readable source form. No compiler, bundler, minifier, or external build step is required.

Installation

Install and activate WooCommerce.
Upload and activate the plugin.
Open Maréva Bangladesh SMS > Gateways and configure GreenWeb, Alpha SMS (sms.bd), MiMSMS, or a custom HTTPS provider.
Review the selected provider’s terms and privacy policy.
Open Maréva Bangladesh SMS > Settings and choose the default and optional fallback gateway.
Send a test SMS before enabling production notifications.

FAQ

Does the plugin send data automatically after activation?: No. An administrator must configure and enable a gateway, and an SMS-producing action must occur.
Is an SMS provider account required?: Yes. This plugin is an integration layer. SMS delivery, availability, pricing, and legal terms are provided by the selected external service.
Does the plugin contain a license check or remote management client?: No. The WordPress.org build has no license gate, telemetry, remote command system, or remote management client.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Maréva Bangladesh SMS & OTP for WooCommerce” is open source software. The following people have contributed to this plugin.

Ashikul Islam

Translate “Maréva Bangladesh SMS & OTP for WooCommerce” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.6.0

Security hardening: Academy LMS REST completion fallback now requires an authenticated user and a state-changing REST method before any SMS side effect is considered.
Security: retained independent target-user authorization so request data cannot select an arbitrary user without permission.
Reliability: WooCommerce notification markers are now saved only when the SMS gateway explicitly reports success or queue acceptance; WP_Error results no longer count as sent.
Re-audited plugin-owned POST/AJAX handlers for nonce, capability, sanitization, and escaping coverage.

1.5.9

Security: removed the unsafe Academy LMS admin-AJAX completion observer that consumed third-party request data without a plugin-verifiable nonce.
Academy LMS completion remains supported through documented/action aliases and the post-dispatch REST fallback.

1.5.7

Fixed Academy LMS course-completion SMS detection for REST and AJAX based learning pages.
Added additional Academy LMS completion hook aliases and safe duplicate protection.

1.5.6

Prevented admin and customer new-order SMS from firing when an online-payment order is only created or remains pending.
New-order notifications are now sent only after confirmed online payment, or after an accepted offline-payment status.
Cleaned WooCommerce currency HTML entities from SMS totals.

1.5.5

Added dedicated cancelled-payment SMS notifications for customer and optional admin.
Added WooCommerce cancelled-order and cancelled-status event handling.
Clarified that a plain browser Back action cannot be detected unless the gateway updates the order or fires a WooCommerce cancellation event.

1.5.4

Deferred online order confirmation SMS until payment succeeds.
Added customer payment-failed SMS and duplicate-event protection.
Prevented payment-complete SMS for unpaid COD/offline orders.

1.5.3

Fixed WooCommerce event registration timing so checkout and order status SMS events are not missed.
Added classic, block checkout, REST checkout, thank-you, processing and completed order fallbacks.
Added Academy LMS enrollment hook aliases and paid-order course enrollment fallback.
Added LMS phone fallback from the customer’s latest WooCommerce order.

1.5.2

Removed legacy BDSMS-named files left behind by older installations.
Confirmed all internal classes, files, hooks, options, tables, assets, and visible branding use the MARVBASM/Maréva naming.

1.5.1

Standardized all visible plugin branding as Maréva Bangladesh SMS.
Resolved output escaping and translator-comment errors reported by Plugin Check.
Improved request sanitization and safe custom-table SQL handling.
Removed the no-longer-required manual translation loader and Domain Path header.

1.5.0

Added the Alpha SMS (sms.bd) gateway using its official HTTPS API endpoint.
Added Alpha SMS to default and fallback gateway selectors and the gateway configuration panel.
Documented the Alpha SMS external service, transmitted data, API documentation, terms, and privacy information.
Rechecked version metadata and PHP syntax for the release package.

1.4.1

Renamed the WordPress admin menu to “Maréva Bangladesh SMS”.
Added an automatic database/version repair routine so required tables are created after an update even when the activation hook does not run.
Rechecked plugin-owned identifiers, external-service disclosures, permissions, nonces, sanitization, escaping, and syntax.

1.4.0

Changed every plugin-owned PHP class, constant, option, database table, transient, AJAX action, hook, asset handle, and interface identifier to the unique marvbasm / MARVBASM prefix.
Removed the legacy generic shortcode and retained only [mareva_sms_otp].
Removed remote licensing, telemetry, heartbeat, and remote command code.
Limited bundled providers to services with documented public Terms and Privacy Policy links.
Rewrote the external-service disclosure with the data sent, reason, timing, and policy links for every bundled provider.
Synchronized plugin and readme versions to 1.4.0.
Rechecked nonce, capability, sanitization, escaping, safe HTTP requests, and PHP syntax.