Zorem Local Pickup for WooCommerce

Zorem Local Pickup for WooCommerce has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 5 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.

Every one of the 5 issues recorded for Zorem Local Pickup for WooCommerce has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Zorem Local Pickup for WooCommerce is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Zorem Local Pickup for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2023-2841

Advanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL Injection

Read the full analysis

Vulnerability Records

5 records
Zorem Local Pickup for WooCommerce banner
Latestv1.9.2

Zorem Local Pickup for WooCommerce

Zorem

Author

Zorem

4.7(55)
94/100
Last Updated
2026-09-08 (5d ago)
Active Installs
3,000+
Downloads
159,549
Requires WP
5.5+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2020-04-21 (7y ago)
Requires Plugins
woocommerce

Zorem Local Pickup extends WooCommerce’s default Local Pickup shipping method into a full click-and-collect fulfillment workflow — with dedicated order statuses, automated customer notifications, and customizable pickup instructions. Out of the box, WooCommerce Local Pickup has no way to tell customers their order is ready for collection, no pickup-specific order status, and no mechanism to share pickup instructions. This plugin fixes all of that, giving you and your customers a clear, professional pickup experience from order placement to collection. HPOS Compatible · 3,000+ Active Stores · Free & Open Source How It Works A customer places an order and selects Local Pickup at checkout. You prepare the order and mark it as Ready for Pickup — the customer instantly receives an email with pickup instructions, location details, and store hours. The customer collects their order. You mark it as Picked Up — optionally sending a final confirmation email. No complex setup. Works with your existing WooCommerce Local Pickup configuration. What’s Included in the Free Version “Ready for Pickup” order status — A dedicated status that triggers an automatic email notification to the customer, letting them know their order is ready for collection. “Picked Up” order status — A second status to confirm collection, with an optional confirmation email. Automated email notifications — Emails fire automatically when you change the order status — no manual messaging needed. Customizable email content — Modify the subject line, heading, and body content of both pickup status emails from the WooCommerce email customizer. Pickup location setup — Add your store name, address, opening hours, and special pickup instructions. These appear automatically in the Ready for Pickup email. Pickup instructions in the Processing email — Optionally show pickup details in the initial order confirmation email so customers know what to expect right away. Pickup instructions on the Thank You page — Display pickup instructions on the order received page immediately after checkout. Bulk order actions — Change multiple orders to Ready for Pickup or Picked Up in bulk from the WooCommerce orders list. HPOS Compatible — Fully compatible with WooCommerce High-Performance Order Storage. Free vs PRO — What’s the Difference? The free version covers single-location pickup workflows. ALP PRO is built for stores with multiple locations, appointment scheduling, and advanced fulfillment needs. ALP Free includes: Ready for Pickup and Picked Up custom order statuses Automated email notifications for both statuses Single pickup location with name, address, hours, and instructions Customizable email content (subject, heading, body) Pickup instructions on Thank You page and Processing email Bulk order status actions HPOS compatible ALP PRO adds: Multiple pickup locations — Add and manage unlimited pickup points, each with its own address, hours, instructions, and contact details. Pickup appointment scheduling — Let customers choose a pickup date and time slot during checkout, with configurable availability per location. Split work hours by day — Define different opening hours for each day of the week per location. Restrict pickup locations by product or category — Assign specific products or categories to specific pickup locations only. Mixed pickup + shipping orders — Support orders where some items are shipped and others are picked up in the same transaction. Per-item pickup from different locations — Allow different items in one order to be picked up from different locations. Location-specific email notifications — Send Ready for Pickup emails from the specific location handling the order, with that location’s details. Pickup discounts — Offer a discount or fee per pickup location to incentivize in-store collection. Force local pickup — Make local pickup the only available shipping method for specific products or categories. Display pickup availability messages — Show customers when pickup is available before they reach checkout. Google Maps integration — Sort pickup locations by distance from the customer’s address. Custom email templates — Advanced pickup email styling and layout customization. Priority support — Faster, dedicated assistance from the Zorem team. 👉 Get ALP PRO Compatible With Zorem Local Pickup is tested and compatible with: Email customizers — Kadence WooMail, YayMail, WP HTML Mail SMS notifications — SMS for WooCommerce Multilingual — WPML (special instruction text translatable) Page builders — Elementor, Divi Subscriptions — WooCommerce Subscriptions (pickup instructions in renewal emails) Multi-vendor — Dokan, WCFM Marketplace Full compatibility list → Translations Zorem Local Pickup is fully translatable. Current translations include English, German, Spanish, French, Hebrew, and Italian. Translate into your language → Documentation & Support 📖 Full documentation and setup guides 💬 WordPress.org support forum More Plugins by Zorem Advanced Shipment Tracking for WooCommerce — The #1 WooCommerce shipment tracking plugin. Trusted by 80,000+ stores. SMS for WooCommerce — Automated SMS order and shipping notifications via Twilio, WhatsApp, and 18 other providers. Zorem Returns — Self-service returns, exchanges, and store credit management for WooCommerce. Customer Email Verification PRO — Block fake accounts and spam orders with OTP-based email verification. Country Based Restrictions PRO — Restrict products and payment gateways by customer country using WooCommerce geolocation. Explore the full catalog at zorem.com →

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C