Dragwyb Click to Chat checks WooCommerce order ownership before returning order details. In the inspected plugin version, the order lookup requires WooCommerce to be active and the visitor to be logged in. A customer can access an order when the order belongs to that WordPress account or its billing email matches the account email; administrators and users with WooCommerce management permissions can also perform lookups.
1. Confirm WooCommerce and order tracking are available
- Confirm WooCommerce is installed and active.
- Open Click to Chat → AI Assistant and review the enabled chatbot features and AI business tools.
- Confirm the order-status lookup tool is available in the configured assistant workflow.
- Test with a known order on staging before troubleshooting a real customer’s order.
2. Sign in to the correct customer account
Guests cannot retrieve order details through the order-status lookup endpoint in the inspected source. Ask the customer to sign in to the WordPress account used for the order, then retry. If the order was placed as a guest, the billing email saved on the order must match the email address on the signed-in WordPress account for the customer ownership check to pass.
Entering an order number alone is not proof of ownership. The current account must pass the plugin’s authorization check before order details are returned.
3. Verify the order identifier and account email
- Use the numeric WooCommerce order ID expected by the lookup form or tool.
- Check that the order exists and has not been removed or migrated to a different store database.
- Compare the order’s saved billing email with the signed-in user’s account email, including spelling and any alternate email address used at checkout.
- If the order is associated with another registered customer account, sign in to that account instead.
- Do not share order details or customer billing information with someone who cannot verify ownership.
4. Understand staff access
Administrators and users who have the manage_woocommerce or manage_options capability can pass the lookup authorization check in the inspected source. Customer access is narrower: the order’s WordPress user ID or billing email must match the signed-in account. Do not grant broader staff capabilities just to work around a customer’s account mismatch.
5. Review the error message
- WooCommerce is not active: activate WooCommerce and confirm its order APIs are available.
- Invalid order ID: enter a valid numeric order identifier.
- Order not found: verify the order ID and the store in which it was created.
- Login required: sign in to a WordPress account before retrying.
- Order email mismatch: use the account that owns the order or whose account email matches the saved billing email.
The exact wording can be customized in the chatbot’s order-tracking messages. A customized message does not remove the underlying ownership check.
6. Test securely
- Test an order owned by the signed-in account.
- Test an order associated with a different account and confirm it is not disclosed.
- Test a guest order whose billing email matches the signed-in account and one that does not.
- Test while logged out and confirm the endpoint requires authentication.
- Use test orders and redacted logs; do not publish real order IDs, addresses, billing emails, or API credentials.
Related guides
Security note: This article reflects the inspected source’s authorization logic. It does not substitute for testing order access on your live configuration with separate customer accounts.