WooCommerce Guest Order Merger Pro — Automatic & OTP-Verified Past Order Linking

Description

Solves a common WooCommerce gap: a customer checks out as a guest, registers an account later, and finds their order history empty — every past purchase is still sitting there under a guest order, disconnected from the account they just created. This automatically matches past guest orders by email and reassigns them to the right account, recalculating lifetime spend and filling in missing billing/shipping details as it goes.

The part worth understanding: linking orders by email match alone is a real account-takeover risk if it’s ever done without proof of mailbox ownership. WordPress’s default registration never verifies that the person creating an account actually controls that email address — so an unverified auto-merge means someone could register with a stranger’s email and instantly see their full order history, shipping addresses, and order notes. This closes that gap with an OTP verification gate: guest orders are never merged silently. The account holder gets a 6-digit code by email, enters it to prove they control the mailbox, and only then are past orders linked — either automatically at registration or on demand from a Verify & Link button in their My Account dashboard. Prefer the old instant-merge behavior anyway? One setting reverts to it.

The verification codes themselves are hashed before storage (never kept in plain text), lock out after 5 wrong attempts, enforce a 60-second cooldown between resend requests so nobody can flood an inbox, and expire after 10 minutes with single-use enforcement. Every completed merge leaves a private order note for admin traceability. Built on WooCommerce’s current CRUD methods, so it works whether your store uses legacy post-based orders or High-Performance Order Storage.

Competitor benchmark: Timersys’s WooCommerce Link Guest Orders — a real, comparable plugin doing basic email-match linking with no identity verification at all — is $29/year for a single site. Priced under that despite including the OTP security layer, brute-force protection, and HPOS compatibility that plugin doesn’t have.