UpsellWP – Upsell and Related Products Offers for WooCommerce Security & Risk Analysis

This plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices in its SQL query handling, utilizing prepared statements exclusively, and has a high rate of output escaping. The absence of critical or high-severity taint flows is also a positive sign. However, significant concerns arise from the substantial attack surface exposed without adequate authentication. Three out of four entry points, all AJAX handlers, lack proper authorization checks, creating a clear pathway for unauthorized actions. The presence of a known, unpatched medium-severity vulnerability, specifically related to missing authorization, further exacerbates this risk. While the plugin has historically shown good practices in other areas, the current state of unpatched vulnerabilities and unprotected entry points necessitates immediate attention.