Overview
PWD WCFM Store Sync is a centralized WordPress plugin installed exclusively on your WCFM Marketplace site. It connects to external WooCommerce vendor stores via the WooCommerce REST API, fetches their product catalogs, and imports them into your marketplace — each product automatically assigned to the correct vendor account.
Vendor-Native Assignment
Uses WCFM's native post_author mechanism. Products appear in vendor dashboards instantly.
One Plugin, Marketplace Only
Install on the marketplace only. Vendors need no plugins — just standard WooCommerce.
SKU-Based Updates
Existing products are updated, not duplicated. Tracked by external product ID and SKU.
Image Sideloading
Product images downloaded to your media library with URL-based de-duplication on re-sync.
Flexible Scheduling
Sync manually, or set each connection to hourly, twice-daily, or daily via WordPress Cron.
Encrypted Secrets
Consumer Secrets stored with AES-256-CBC encryption. Keys never stored in plain text.
Requirements
Marketplace Site (where this plugin is installed)
| Component | Minimum Version | Notes |
|---|---|---|
| WordPress | 6.0 | Tested up to 6.7 |
| PHP | 7.4 | PHP 8.0/8.1/8.2 compatible. OpenSSL extension required. |
| WooCommerce | 5.0 | Tested up to 9.7.0. HPOS supported. |
| WCFM – WooCommerce Frontend Manager | Any | Must be active. |
| WCFM – Multivendor Marketplace | Any | Must be active. |
| WCFM – Marketplace REST API | 1.6.3+ | Auto-installed by this plugin if missing. |
External Vendor Stores (no plugin installation needed)
| Requirement | Details |
|---|---|
| WordPress + WooCommerce | Standard installation with products to sync. |
| Pretty Permalinks | Required for REST API. Go to Settings → Permalinks → Post name. |
| WooCommerce REST API | Enabled by default in WooCommerce. |
| API Credentials | Consumer Key and Secret with Read permission. Generated in WooCommerce → Settings → Advanced → REST API. |
Installation
Via WordPress Admin (Recommended)
Upload the Plugin
Go to Plugins → Add New → Upload Plugin and upload pwd-wcfm-store-sync.zip.
Activate
Click Install Now, then Activate Plugin.
Install Dependency (if prompted)
If WCFM REST API is not installed, a notice will appear at the top of every admin page. Click Install & Activate Now — done in one click.
You're Ready
Navigate to WooCommerce → Store Sync to begin.
The plugin creates three database tables on activation: pwd_wcfm_sync_connections, pwd_wcfm_sync_log, and pwd_wcfm_sync_products. These are removed when you uninstall.
First Setup
Open Store Sync
Go to WooCommerce → Store Sync in your WordPress admin.
Add a Connection
Click Add New Connection.
Fill In the Form
Select a vendor, paste the external store URL and API credentials, choose a sync schedule and default product status.
Save and Sync
Click Save Connection, then back on the connections list click Sync Now to run the first import.
Review Results
Check WooCommerce → Sync Logs for a detailed report. Products will appear in the vendor's WCFM dashboard immediately.
Connections
A Connection is a saved link between one vendor account and one external WooCommerce store. You can have multiple connections per vendor (multiple external stores) or multiple connections on the same external store pointing to different vendors.
Connection Fields
| Field | Required | Description |
|---|---|---|
| Connection Name | No | A friendly label to identify this connection in the admin. |
| Assign to Vendor | Yes | The WCFM vendor account all synced products will be assigned to. |
| External Store URL | Yes | Base URL of the vendor's WooCommerce store, e.g. https://vendorstore.com. Do not include /wp-json. |
| Consumer Key | Yes | WooCommerce API Consumer Key from the external store. |
| Consumer Secret | Yes (on create) | WooCommerce API Consumer Secret. Stored encrypted. Leave blank when editing to keep existing value. |
| Active | No | Toggle to enable or disable this connection. Disabled connections are skipped during scheduled syncs. |
| Sync Schedule | No | How often to sync automatically: Manual Only, Hourly, Twice Daily, Daily. |
| Default Product Status | No | Status for newly synced products: Published, Pending Review, or Draft. |
API Credentials
You need WooCommerce REST API credentials from the external (vendor's) store, not the marketplace. These are generated inside the vendor's WordPress admin.
Log in to the Vendor's Store Admin
Access the WordPress dashboard at https://vendorstore.com/wp-admin.
Navigate to REST API Settings
Go to WooCommerce → Settings → Advanced → REST API.
Add a New Key
Click Add key. Set a Description (e.g. "Marketplace Sync"), choose any User, and set Permissions to Read.
Copy Both Keys
The Consumer Key and Consumer Secret are shown only once. Copy them immediately and paste into the connection form on your marketplace.
The Consumer Secret is shown only once and cannot be retrieved again. Copy it before navigating away from the WooCommerce API key page.
Required Permissions
Set the API key permission to Read. The plugin only reads products from the external store — it never writes to it.
Plugin Settings
Accessible from WooCommerce → Sync Settings.
| Setting | Default | Description |
|---|---|---|
| Enable Scheduled Sync | Off | Master toggle for automatic scheduled syncing. Connections with a schedule set will run via WordPress Cron. |
| Sync Product Images | On | Downloads and imports product images. Disable to speed up sync on large catalogs. |
| Log Retention | 30 days | Log entries older than this are auto-pruned after each sync. |
| Error Notifications | Off | Sends an email when a sync error occurs. |
| Notification Email | Admin email | Where error notification emails are sent. |
Sync Scheduling
Scheduled syncing uses WordPress Cron. Two things must be true for a connection to sync automatically:
- Sync Settings → Enable Scheduled Sync must be turned on.
- The connection's Sync Schedule must not be set to "Manual Only".
| Schedule Option | Frequency |
|---|---|
| Manual Only | Never runs automatically. Must click "Sync Now". |
| Hourly | Runs approximately every 60 minutes. |
| Twice Daily | Runs approximately every 12 hours. |
| Daily | Runs approximately every 24 hours. |
WordPress Cron is triggered by site traffic. On low-traffic sites, scheduled events may run late. Consider a real cron job via wp-cron.php for reliable timing.
Architecture
The plugin follows a centralized hub-and-spoke model. The marketplace is the hub. External vendor stores are the spokes. All logic resides in one plugin on the marketplace — vendor stores need nothing installed.
Sync direction is one-way only: External Store → WCFM Marketplace. The plugin never writes to or modifies external stores.
Why WooCommerce API (not WCFM API) for Product Creation?
The WCFM REST API is designed for logged-in vendors managing their own products. For admin-driven bulk imports with vendor assignment, the standard WooCommerce REST API gives direct control over post_author — the field WCFM uses internally to identify vendor product ownership. This is the proven, supported method confirmed in WCFM's own support forums.
Data Flow
Trigger
Manual click or Cron event
Fetch
GET products from external WC REST API (paginated)
Check
Existing? Match by external ID or SKU
Transform
Map fields, categories, attributes
Create / Update
wp_insert_post with post_author = vendor
Images
Download & sideload to media library
Log
Record result for each product
The engine handles pagination automatically — no matter how many products the external store has, all pages are fetched in sequence (50 products per page).
Vendor Assignment
This is the most critical part of the plugin. WCFM identifies which products belong to which vendor using the WordPress post_author field on the product's post record.
Confirmed from WCFM source code: In class-wcfm-vendor-support.php, the admin product association UI explicitly sets 'post_author' => $vendor_user_id via wp_update_post(). This plugin replicates the same assignment at the wp_insert_post() level.
After creating a product, the plugin also:
- Verifies the
post_authoris set correctly via a follow-upwp_update_post()call. - Checks for and sets the
wcfm_vendor_taxonomyterm if that taxonomy is registered. - Fires the
wcfm_after_product_author_updateandwcfm_sync_product_vendor_assignedaction hooks for third-party compatibility.
What Gets Synced
| Product Field | Mapped From External API | Notes |
|---|---|---|
| Title | name | |
| Description | description | HTML preserved (kses filtered) |
| Short Description | short_description | |
| SKU | sku | Used for duplicate detection |
| Regular Price | regular_price | Markup applied if Price Adjustment is configured |
| Sale Price | sale_price | Markup applied if Price Adjustment is configured |
| Stock Status | in_stock | instock / outofstock |
| Stock Quantity | stock_quantity | |
| Manage Stock | manage_stock | |
| Weight | weight | |
| Dimensions | dimensions.length/width/height | |
| Product Type | type | simple, variable, grouped, external |
| Virtual / Downloadable | virtual, downloadable | |
| Featured | featured | |
| Categories | categories[].name | Created on marketplace if not existing |
| Tags | tags[].name | |
| Attributes | attributes[] | Global and custom, with variations flag |
| Featured Image | images[0] | Downloaded to media library |
| Gallery Images | images[1+] | Downloaded and set as gallery |
Connections List
Found at WooCommerce → Store Sync. This is the main management page.
- Lists all connections with vendor name, external URL, active status, synced product count, schedule, and last sync time.
- Sync Now — triggers an immediate sync for that connection. Results appear inline after completion.
- Edit — opens the connection form to modify settings.
- Logs — jumps to the filtered log view for that connection.
- Delete — removes the connection and all related log entries and product mappings (marketplace products are not deleted).
Sync Logs
Found at WooCommerce → Sync Logs. Shows all sync activity across all connections.
- Filter by Connection and Log Level (Info, Success, Warning, Error).
- Each entry shows: timestamp, level, connection name, message, and optional context data.
- Paginated at 50 entries per page.
- Use Clear Logs to remove all entries for a specific connection.
- Logs are automatically pruned based on the Log Retention setting after each sync.
Log Levels
| Level | Meaning |
|---|---|
| ℹ️ Info | General status messages — sync started, page fetched, etc. |
| ✅ Success | A product was created or a sync completed successfully. |
| ⚠️ Warning | Non-fatal issue — e.g., an image couldn't be downloaded. |
| ❌ Error | Failed to process a product or connect to external store. Triggers email if configured. |
Settings Page
Found at WooCommerce → Sync Settings. Includes a live Plugin Status panel showing:
- WooCommerce: active/inactive + version
- WCFM Marketplace: active/inactive
- WCFM REST API: active/inactive (with install prompt if missing)
- Plugin version
The settings form is divided into five sections: Sync Settings, Product Approval, Price Adjustment, Logging, and Email Notifications.
Product Approval
Found in WooCommerce → Sync Settings → Product Approval.
When Require Approval for Imports is enabled, all newly imported products are created with WordPress post status pending (Pending Review) rather than the per-connection Default Product Status. The marketplace admin must review and approve each product before it goes live on the storefront.
Important: Products that are updated on re-sync (i.e. they already exist on the marketplace) are not affected — their current post_status is read from the database and preserved. An approved/published product will never be reverted to pending by a subsequent sync.
| Setting | Behaviour |
|---|---|
| Disabled (default) | New products use the per-connection Default Product Status (Published, Pending, or Draft). |
| Enabled | All new imports are forced to pending regardless of connection status setting. Updated products keep their existing status. |
To approve a pending product, go to WooCommerce → Products, find the product with "Pending Review" status, and publish it — or use WCFM's built-in Mark Approve / Publish action from the WCFM products list.
Price Adjustment
Found in WooCommerce → Sync Settings → Price Adjustment.
Automatically marks up imported product prices so you never need to adjust prices manually after a sync — even when importing hundreds of products.
How It Works
The three percentage fields — Commission, VAT, and Admin Fee — are added together to form a single total markup percentage. This multiplier is applied to the source product's regular_price, sale_price, and price fields.
total_markup = commission% + VAT% + admin_fee%
multiplier = 1 + (total_markup / 100)
adjusted_price = source_price × multiplier
// Example: source = R100, commission = 10%, VAT = 15%, admin = 5%
total_markup = 30%
multiplier = 1.30
adjusted_price = R100 × 1.30 = R130.00
| Field | Purpose | Default |
|---|---|---|
| Commission (%) | Marketplace commission taken from vendor revenue — added to the listed price so the vendor receives the correct net amount. | 0 |
| VAT (%) | Value-Added Tax or any applicable sales tax to include in the listed price. | 0 |
| Admin Fee (%) | Any additional marketplace admin or handling fee. | 0 |
A Live Preview widget below the fields shows the resulting price for a R100 base product in real time as you type — no need to save and test.
Applies to both new and updated products. Unlike Product Approval, price adjustment is applied every time a product is synced. The multiplier used is stored on each product as _pwd_sync_price_multiplier post meta for auditing purposes.
Setting All Fields to 0
When all three fields are 0 (the default), no markup is applied and prices are imported exactly as they appear in the source store. Individual fields can be set to 0 to exclude that component.
Security
| Concern | Mitigation |
|---|---|
| Credential storage | Consumer Secrets encrypted with AES-256-CBC using a unique per-site key stored in wp_options. |
| Admin access | All admin pages check manage_woocommerce capability. AJAX handlers verify nonces and capability. |
| Form submissions | All forms use wp_nonce_field() verified with check_admin_referer(). |
| Data sanitization | All inputs sanitized: sanitize_text_field(), esc_url_raw(), absint(), wp_kses_post(). |
| Database queries | All queries use $wpdb->prepare() with placeholders. |
| External SSL | SSL verification enabled by default. Override with pwd_wcfm_sync_sslverify filter. |
| Image downloads | Uses WordPress download_url() and media_handle_sideload() — standard WordPress image import pipeline. |
FAQ
Does the vendor need to install anything on their store?
No. Vendors only need a standard WordPress + WooCommerce installation with the REST API accessible (enabled by default). They generate an API key from their WooCommerce settings and share the credentials with you.
Will products appear in the vendor's WCFM dashboard immediately?
Yes. Products are assigned using the post_author field, which is the same mechanism WCFM uses internally. They will appear in the vendor's product list and store front immediately after sync completes.
Can I sync multiple external stores to one vendor?
Yes. Create multiple connections pointing to different external stores and assign them to the same vendor account. Each connection is independent.
What happens if a product already exists?
The plugin first checks the product mapping table by external product ID, then by SKU. If a match is found, the existing marketplace product is updated, not duplicated.
Are product images copied to my server?
When image sync is enabled (default), images are downloaded to your WordPress media library. On subsequent syncs, the plugin checks a stored source URL meta field and skips downloading already-imported images.
Does this sync orders or customers?
No. This plugin is products-only by design. No orders, customers, reviews, or coupons are synced.
What if the external store has hundreds of products?
The sync engine paginates automatically (50 products per request). For very large catalogs run via the "Sync Now" button, you may hit PHP execution time limits. Consider triggering syncs via WP-CLI or the scheduled cron for large imports.
Can I sync variable products?
The product type (including "variable") is mapped, but full variation creation (child posts with attributes) is on the roadmap. Currently, variable products are created with their product type set but without individual variation posts.
Troubleshooting
Sync returns "Failed to connect to external store"
- Verify the external store URL is correct and reachable from your server.
- Check that the external store has pretty permalinks enabled (
Settings → Permalinks → Post name). - Test the API directly:
https://vendorstore.com/wp-json/wc/v3/productsshould return JSON. - On local/staging environments, SSL errors may appear. Add the
pwd_wcfm_sync_sslverifyfilter to disable SSL verification.
Sync returns HTTP 401 Unauthorized
- Double-check the Consumer Key and Consumer Secret are correct.
- Ensure the API key has at minimum Read permission.
- Some server configurations block Basic Auth headers. Check if the external store's
.htaccessneeds to pass auth headers through.
Add this to the external store's .htaccess if Basic Auth is being stripped by Apache:RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
Products are created but not showing in vendor's dashboard
- Confirm the selected vendor user has the
wcfm_vendor,seller, orvendorrole. - Check the
post_authorof the synced product in WordPress → Database. It should match the vendor's user ID. - Check WCFM's "Manage Products" page from the vendor's frontend. It filters by
post_author.
Images are not being imported
- Check that Sync Product Images is enabled in Plugin Settings.
- Ensure your server can make outbound HTTP requests to the external store.
- Check the sync log for specific image download errors.
- Verify your
wp-content/uploadsdirectory is writable.
Scheduled sync is not running
- Confirm Enable Scheduled Sync is on in Plugin Settings.
- Confirm the connection's Sync Schedule is not set to "Manual Only".
- WordPress Cron requires site traffic to trigger. Use a system cron job calling
wp-cron.phpfor reliable scheduling. - Check with a plugin like WP Crontrol to confirm the
pwd_wcfm_sync_cron_eventis scheduled.
For additional support, visit prowebdesign.co.za and contact the support team.
Changelog
1.0.4
LATEST March 2026- New Product Approval setting — when enabled, all newly imported products are saved as Pending Review regardless of the per-connection Default Product Status. Existing products updated on re-sync preserve their current status so already-approved products are never reverted.
- New Price Adjustment settings section — three independent percentage fields (Commission, VAT, Admin Fee) whose values are summed and applied as a single markup multiplier on all imported product prices (regular price, sale price, and displayed price). A live preview widget in the settings UI shows the resulting price in real time.
- New
_pwd_sync_price_multiplierpost meta stored on each synced product for auditing the markup factor that was applied at import time. - Improved
update_marketplace_product()now explicitly reads and preserves the existingpost_statusfrom the database on re-sync instead of blindly passing the value fromtransform_product().
1.0.2
March 2026- Fixed Plugin Update Checker not sending license credentials —
buildUpdateCheckerandaddQueryArgFiltermoved to direct file scope (not insideplugins_loadedcallback) so update checks now correctly includelicense_keyandemail, and thedownload_urlis returned by the update server. - Improved Rebuilt top navigation bar as a fully self-contained component with inline styles and SVG icons — no longer dependent on external CSS load order or WordPress admin style specificity.
1.0.1
March 2026- New SLM Plus license activation and daily background verification.
- New Plugin Update Checker (PUC v5.6) for automatic update notifications from the Pro Web Design update server.
- New License admin page (WooCommerce → Sync License) — always accessible, with active/inactive UI.
- New License gate: all plugin features are disabled until a valid license key is activated.
- New Red badge on License menu item and Plugins page row meta when license is not active.
- New Email-lock on daily license check: mismatched purchase email marks license invalid (prevents nulled copies).
- New 3-consecutive-failure tolerance for transient network issues before marking license invalid.
- New Deactivation hook to clean up license cron event.
1.0.0
March 2026- Initial release.
- Connections manager with vendor assignment and encrypted credential storage.
- Core sync engine: paginated fetch, SKU-based duplicate detection, image sideloading.
- Admin UI: connections list, add/edit forms, filterable log viewer, settings page.
- WordPress Cron integration for scheduled syncing (manual / hourly / twice-daily / daily).
- Auto-install of WCFM Marketplace REST API from WordPress.org.
- WooCommerce HPOS compatibility declared.
- Product type, category, tag, and attribute mapping.
Credits & License
Plugin Information
- Plugin Name: PWD WCFM Store Sync
- Current Version: 1.0.4
- Author: Pro Web Design
- Author URI: https://prowebdesign.co.za/
- Plugin URI: https://prowebdesign.co.za/product/pwd-wcfm-store-sync/
- License: GPLv2 or later
License
This plugin is licensed under the GNU General Public License v2 or later. You are free to redistribute and modify it under the terms of the GPL. See gnu.org/licenses/gpl-2.0.html for the full license text.