Dynamic Pricing With Discount Rules for WooCommerce Security & Risk Analysis

The "aco-woo-dynamic-pricing" plugin version 4.5.10 presents a mixed security posture with significant areas for improvement. While it demonstrates some good practices like avoiding external HTTP requests and file operations, critical security concerns arise from its large attack surface with unprotected entry points. Specifically, six AJAX handlers lack authentication checks, leaving them vulnerable to unauthorized execution of actions. Additionally, the presence of the `unserialize` function, a known source of code injection vulnerabilities, coupled with a substantial percentage of SQL queries not using prepared statements, raises red flags regarding potential injection attacks. The plugin's vulnerability history, which includes past High and Medium severity CVEs related to Code Injection and SQL Injection, reinforces these concerns, indicating a pattern of exploitable weaknesses. Although there are no currently unpatched CVEs, the historical data suggests a propensity for vulnerabilities that require diligent patching. The taint analysis showing flows with unsanitized paths, while not critical or high severity in this instance, also points to potential risks if data is not handled rigorously.