AdMail – Multilingual Back in-Stock Notifier for WooCommerce Security & Risk Analysis

The 'admail' plugin v1.7.0 exhibits a mixed security posture. While it demonstrates good practices in output escaping and the use of prepared statements for SQL queries, significant concerns arise from its extensive attack surface and lack of robust authorization checks. A large proportion of its AJAX handlers, which represent potential entry points for attackers, are not protected by authentication, posing a substantial risk of unauthorized actions. The presence of multiple unsanitized taint flows, particularly those categorized as high severity, further amplifies these concerns, indicating potential for data manipulation or execution of unintended code. The plugin's history of a medium-severity vulnerability, although recently patched, alongside the persistent issue of missing authorization, suggests a recurring weakness in how user privileges and access are managed. The plugin's strengths lie in its careful handling of output and database interactions, but these are overshadowed by significant vulnerabilities in its access control mechanisms. Users should proceed with caution and consider disabling or thoroughly auditing the plugin.