EmailKit – Email Customizer for WooCommerce & WP Security & Risk Analysis

The "emailkit" v1.6.3 plugin exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. The presence of unprotected AJAX handlers and REST API routes without permission callbacks represents a substantial risk of unauthorized access and potential data manipulation. The absence of taint analysis results suggests that while static analysis did not reveal obvious direct vulnerabilities, the lack of authorization checks on numerous entry points remains a critical area of concern.

The plugin's vulnerability history, with three past medium-severity CVEs, including "External Control of File Name or Path" and "Missing Authorization," directly correlates with the identified weaknesses in the static analysis. The fact that these vulnerabilities are marked as currently unpatched is a significant red flag, indicating a persistent lack of attention to critical security flaws. While the plugin benefits from proper SQL handling and output escaping, the numerous unprotected entry points and the history of authorization-related vulnerabilities suggest a need for immediate attention to secure these pathways and address any outstanding CVEs.

In conclusion, "emailkit" v1.6.3 has several strengths, notably in its database and output handling. However, these are overshadowed by critical weaknesses in its attack surface management, specifically the numerous unprotected AJAX and REST API endpoints. The historical trend of medium-severity vulnerabilities, particularly those related to authorization and file path control, combined with the current lack of patching, presents a moderate to high risk to WordPress sites using this plugin. It is recommended that users exercise caution and consider alternatives or ensure that the plugin is updated with security patches if available.