Site.pro for WooCommerce Security & Risk Analysis

The b1-accounting plugin version 2.2.65 exhibits a concerning security posture primarily due to its extensive attack surface of unprotected AJAX handlers. While the plugin shows good practices in terms of SQL query preparation and a lack of dangerous functions or file operations, the presence of 14 AJAX handlers without any authentication checks represents a significant vulnerability. This means that any unauthenticated user could potentially trigger these handlers, leading to unintended actions or information disclosure.

Taint analysis reveals two flows with unsanitized paths, though thankfully no critical or high severity issues were identified in this area. However, the plugin's vulnerability history is a significant red flag. With two known CVEs, one high and one medium, and a recent vulnerability discovered in July 2025, it indicates a pattern of security weaknesses. The common vulnerability types of SQL Injection and Missing Authorization directly correlate with the observed unprotected AJAX handlers.

In conclusion, while the plugin demonstrates some strengths in secure coding practices like prepared statements, the critical flaw of numerous unprotected AJAX endpoints and a history of significant vulnerabilities heavily outweigh these positives. The likelihood of exploitation is high due to the large, accessible attack surface, and the plugin's past suggests a recurring inability to address authorization and input sanitization effectively.