CDI – Collect and Deliver Interface for Woocommerce Security & Risk Analysis

This plugin exhibits a concerning security posture due to a significantly exposed attack surface. All 30 identified AJAX handlers lack authentication checks, creating a broad entry point for potential attackers to exploit. The presence of unsanitized paths in taint analysis, even without critical or high severity findings, indicates a potential for vulnerabilities if malicious data is passed through these flows. The use of the `unserialize` function is a known risk, especially when dealing with user-controlled input, as it can lead to remote code execution if not handled with extreme care. The plugin also shows a history of vulnerabilities, including a high severity one related to unrestricted file uploads and cross-site scripting, suggesting recurring issues with input validation and secure handling of uploaded content. While the plugin demonstrates good practices in output escaping and uses prepared statements for a majority of SQL queries, the critical lack of authorization on its AJAX endpoints and the historical vulnerability patterns outweigh these strengths, necessitating immediate attention.