Bookingor – Booking System for Appointment Calendar, Meeting Scheduler & WooCommerce Bookings Security & Risk Analysis

The "bookingor" plugin version 2.0.14 exhibits a concerning security posture, primarily due to a large number of unprotected AJAX handlers. While the plugin demonstrates good practices in SQL query preparation and output escaping, the sheer volume of exposed entry points (71 out of 80 total) significantly increases the attack surface. This lack of authentication checks on AJAX endpoints presents a high risk for unauthorized actions. The taint analysis revealing two high-severity flows with unsanitized paths further exacerbates these concerns, indicating potential for malicious data manipulation or execution if these flows are triggered. The vulnerability history, particularly the presence of two medium-severity CVEs and one currently unpatched vulnerability, points to a recurring pattern of missing authorization, reinforcing the findings from the static analysis. Although the plugin has strengths in its handling of SQL and output, the identified weaknesses in authorization and the presence of unpatched vulnerabilities are critical issues that require immediate attention. The unpatched CVE is a significant risk as it's a known vulnerability that could be exploited.