Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager Security & Risk Analysis

The plugin "flexible-checkout-fields" v4.1.36 exhibits a mixed security posture, with some positive indicators but also several concerning elements that warrant attention. On the positive side, the plugin has a relatively small attack surface with only one AJAX handler, and importantly, it appears to have an authentication check on this entry point. The high percentage of properly escaped outputs (82%) suggests a general awareness of output sanitization, and the presence of nonce and capability checks further contributes to good security practices. However, the static analysis reveals the use of several dangerous functions, including `unserialize`, `proc_open`, and `shell_exec`, which can be exploited if not handled with extreme care and robust input validation. Additionally, the absence of prepared statements for all SQL queries is a significant risk, as it opens the door to SQL injection vulnerabilities. The taint analysis highlights critical flows with unsanitized paths, indicating potential for malicious input to be processed in an unsafe manner.

The vulnerability history of this plugin is a significant concern. With two known CVEs, including a high-severity one, and a recent vulnerability in April 2024, it suggests a recurring pattern of security weaknesses. The common types of vulnerabilities found in the past (Missing Authorization, Cross-site Scripting) align with the potential risks identified in the static and taint analyses. While there are currently no unpatched CVEs, the history indicates a persistent need for rigorous security auditing and prompt patching. The plugin demonstrates strengths in output escaping and the presence of some security checks, but the use of dangerous functions, lack of prepared statements for all SQL, critical taint flows, and a history of significant vulnerabilities collectively point to a moderate to high-risk profile that requires ongoing vigilance.