wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce Security & Risk Analysis

The catalog-mode-pricing-enquiry-forms-promotions plugin version 1.3.2 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in several areas, including a high percentage of SQL queries using prepared statements and properly escaped output. It also has a reasonable number of nonce and capability checks, and no concerning file operations or external HTTP requests were identified. Furthermore, the taint analysis did not reveal any critical or high-severity unsanitized flows.

However, a significant concern lies in the identified attack surface. The plugin exposes one AJAX handler that lacks authentication checks. This means that any user, regardless of their WordPress role, could potentially trigger this handler, leading to unintended actions or information disclosure if the handler performs sensitive operations. While the vulnerability history shows no currently unpatched CVEs, the presence of a past medium-severity vulnerability, specifically related to Missing Authorization, reinforces the importance of robust authorization checks on all entry points.

In conclusion, while the plugin has strengths in its code hygiene regarding SQL and output escaping, the unprotected AJAX endpoint is a notable weakness. The historical vulnerability also highlights a recurring theme that needs attention. Addressing the unprotected AJAX handler is paramount to improving the plugin's overall security. The absence of critical vulnerabilities in the current analysis is positive, but the identified attack vector warrants immediate remediation.