Connector for WooToApp Mobile – WooCommerce Native Mobile App. Security & Risk Analysis

The "connector-for-wootoapp-mobile" v1.0.8 plugin presents a mixed security posture. On the positive side, it demonstrates good practices by not utilizing dangerous functions, all SQL queries are prepared, and there are no recorded vulnerabilities in its history. However, significant concerns arise from its attack surface and taint analysis.

The plugin exposes two AJAX handlers, both of which lack authentication checks. This is a critical oversight, as it allows unauthenticated users to trigger plugin functionality. Furthermore, the taint analysis revealed three high-severity flows with unsanitized paths. This indicates potential vulnerabilities where external data could be used in a way that leads to unintended or malicious actions, despite the absence of specific CVEs.

The lack of vulnerability history might suggest that the plugin has not been a frequent target or that previous issues have been addressed. However, the presence of critical code analysis signals, particularly the unprotected AJAX endpoints and high-severity taint flows, overshadow this positive aspect. The overall risk is elevated due to these direct code-level security weaknesses, which could be exploited even without a known public vulnerability.