Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Security & Risk Analysis

The plugin "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light" v2.4.37 exhibits significant security concerns, primarily due to its historical vulnerability profile and certain insecure coding practices revealed in the static analysis. With a history of 5 known CVEs, all of which remain unpatched and include 3 critical and 2 high severity vulnerabilities, the plugin has a well-documented pattern of critical security flaws. These past issues span SQL Injection, Path Traversal, Code Injection, Incorrect Privilege Assignment, and PHP Remote File Inclusion, suggesting systemic weaknesses in input validation and access control.

The static analysis reveals an attack surface of 24 entry points, with 5 AJAX handlers lacking authentication checks, presenting an immediate risk of unauthorized execution. While the plugin uses prepared statements for 83% of its SQL queries and has a decent number of capability checks (13), the presence of the `unserialize` function is a red flag, especially given the historical code injection vulnerabilities. Furthermore, only 53% of output is properly escaped, increasing the risk of cross-site scripting (XSS) attacks, and one taint flow with an unsanitized path indicates potential path traversal issues.

Overall, the plugin's security posture is poor. The substantial number of unpatched critical and high severity vulnerabilities, coupled with the identified insecure coding practices like unprotected AJAX endpoints and the use of `unserialize`, create a high-risk environment for WordPress sites. While the use of prepared statements and some capability checks are positive indicators, they are overshadowed by the persistent and severe historical vulnerabilities and the immediate risks identified in the static analysis.