Product Compare for WooCommerce by DITS Security & Risk Analysis

The "dits-compare" plugin v1.1.2 exhibits several positive security practices, including 100% proper output escaping and the absence of dangerous functions or file operations. All SQL queries are correctly implemented using prepared statements, and there are no external HTTP requests. This indicates a developer aware of basic secure coding principles. However, the plugin has two unprotected AJAX handlers, which represent a significant attack surface. The lack of nonce checks or capability checks on these entry points exposes them to potential Cross-Site Request Forgery (CSRF) attacks or unauthorized access to plugin functionalities by unauthenticated users. The plugin also has no recorded vulnerability history, which is a positive sign, but the current lack of protection on its AJAX endpoints is a critical concern that needs immediate attention. Despite its strengths in other areas, the unprotected AJAX handlers are a substantial weakness.