Ever Compare – Products Compare Plugin for WooCommerce Security & Risk Analysis

The 'ever-compare' plugin v1.3.5 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries, avoiding file operations and external HTTP requests, and not bundling any libraries. The absence of critical or high-severity vulnerabilities in its history, with the last reported vulnerability being a medium in February 2023, is also encouraging. However, concerns arise from the significant attack surface, particularly the presence of 8 AJAX handlers with 4 lacking authentication checks. This opens up potential avenues for unauthorized actions if these handlers are not properly secured at the application level.

The static analysis reveals a notable lack of proper authorization checks on a substantial portion of its AJAX endpoints, representing the most immediate risk. While no dangerous functions or SQL injection vulnerabilities were detected, and output escaping is generally well-implemented, the unprotected entry points are a critical weakness. The vulnerability history, while mostly clear, does indicate a past medium-severity issue, suggesting that while the developers have addressed vulnerabilities, vigilance is still required.

In conclusion, the plugin has strengths in its secure handling of database interactions and avoiding common risky behaviors. Nevertheless, the unsecured AJAX handlers present a clear and present danger that needs immediate attention. Addressing these unprotected entry points should be the priority to significantly improve the plugin's security posture.