Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD Security & Risk Analysis

The "cart-lift" v3.1.55 plugin presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a decent number of nonce and capability checks, significant concerns exist. The plugin has a broad attack surface, with 14 AJAX handlers, 12 of which lack authorization checks, creating a substantial risk of unauthorized actions. Furthermore, the taint analysis reveals 7 high-severity flows with unsanitized paths, indicating a strong possibility of code injection or data manipulation vulnerabilities. The presence of the "unserialize" function is also a red flag, as it can be a vector for deserialization vulnerabilities if not handled with extreme care and proper input validation.

The vulnerability history shows 2 previously disclosed medium-severity CVEs, specifically related to Cross-site Scripting and Missing Authorization. While there are currently no unpatched vulnerabilities, the recurring pattern of missing authorization and input handling issues, as seen in both historical CVEs and current taint analysis, suggests a persistent weakness in how user input is processed and secured. The fact that 26% of outputs are not properly escaped also contributes to the XSS risk.

In conclusion, while "cart-lift" v3.1.55 has some strengths, the high number of unprotected AJAX handlers, significant high-severity taint flows, and past vulnerabilities in authorization and XSS point to a considerable risk. The use of `unserialize` without further context is also a concern. Recommendations should focus on strengthening authorization checks for all AJAX endpoints and thoroughly sanitizing all input that is passed to dangerous functions like `unserialize` and used in output.