Inference Works Order Invoice Attach for WooCommerce

Inference Works Order Invoice Attach for WooCommerce is for shops that issue invoices in an external accounting tool and only need WooCommerce to deliver the finished PDF.

This plugin does not generate invoices. It does not talk to any accounting API, assign numbers, or create credit notes. You upload a PDF on the order screen; the plugin stores it privately and attaches it to the emails you choose.

What it does

• Upload a PDF invoice on the WooCommerce order edit screen (classic and High-Performance Order Storage).
• Attach that file to selected customer emails (completed, processing, refunded, or the manual invoice email).
• Let the customer download the same file from My Account when a PDF is present.
• Warn — or optionally block a manual status change — if you try to complete an order with no invoice uploaded.
• Store files under a random name inside uploads and provide a permission-checked download endpoint.

Storage and security

Files live in wp-content/uploads/iwoia-invoices/{year}/{month}/ with a 32-character random filename. The original name is never used on disk. An index.php and .htaccess (Deny from all) are written in the root folder as extra Apache protection.

Nginx ignores .htaccess. Configure your server to deny direct public access to the invoice directories. Without such protection, someone who knows a direct PDF URL may bypass the download endpoint. Random names make URLs difficult to guess but do not replace access control. Direct storage URLs are not exposed by this plugin’s emails or admin interface.

Existing invoices from versions up to 1.1.0 remain in oia-invoices and remain readable. New uploads use iwoia-invoices. Apply the server access restriction to both directories when upgrading.

Download is allowed for shop managers, the logged-in order owner, or anyone with a valid order key (guest links).

Privacy

The plugin registers a personal data exporter (reports that an invoice file exists on an order) and an eraser (deletes the file). No remote requests, telemetry, or third-party scripts.