Discountify – WooCommerce Discount Plugin for Discount Rules & Dynamic Pricing Security & Risk Analysis

Discountify v1.0.84 exhibits a mixed security posture. On the positive side, it demonstrates good practices in areas such as SQL query sanitization and output escaping, with a very high percentage of outputs being properly escaped. The absence of known vulnerabilities and a clean vulnerability history are also strong indicators of a well-maintained plugin. However, a significant concern arises from the presence of two unprotected AJAX handlers, which represent an open attack surface. While no critical taint flows or dangerous functions were detected, the unprotected AJAX endpoints could potentially be exploited if they handle user-supplied data without proper validation and authorization, allowing for unauthorized actions or information disclosure.

The plugin's vulnerability history is clean, showing no past issues, which is encouraging. This suggests a proactive approach to security from the developers. However, the presence of unprotected AJAX handlers, despite the clean history, highlights a potential blind spot or oversight that needs addressing. The plugin's strengths lie in its secure handling of SQL and outputs, but its weakness is the exposed AJAX endpoints. Overall, the plugin is in a relatively good state, but the identified attack surface requires immediate attention to prevent potential vulnerabilities.