Privacy issue: files stored in /uploads/ (Fixed in new version?)

Because the generated invoices are stored in /uploads/ there is no simple way to block direct access to them. This represents a significant privacy violation for customers.

I tried several things:

writing the author (no reply.)

htaccess controls (because they’re recursive, they also blocked free downloads in the /uploads/year/etc. folders. This can be overridden by an htaccess file in each year folder, but that seemed like a ticking time bomb.)

talked with WP Engine about nxing rules, but they came up empty.

I suspect it would be a pretty easy fix in the plug-in, but I decided not to edit the plug-in because it would have cost my client as much as the solution I found: buying the paid WOOCommerce extension instead. It’s too bad because this should be a simple thing to fix: simply moving the storage location into a subdirectory like /uploads/wooinvoices or a subdirectory associated with the plugin would allow use of htaccess rules without affecting other pdfs that are legitimate downloads. The latter would even allow the plugin to ship with htaccess rules already configured I think. (I’ve never tried adding an htaccess to a plugin, but I don’t know of any reason it would be disallowed.)

Anyway, it could be a really useful plugin, but in this case you get what you pay for. I’d consider exposing purchase and personal information for customers to be a pretty serious privacy violation.