Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce Security & Risk Analysis

The "flexible-coupons" plugin v1.14.2 presents a mixed security posture. While it exhibits some good practices such as a moderate number of nonce and capability checks, its static analysis reveals significant concerns. The presence of several dangerous functions like `proc_open`, `shell_exec`, and `passthru` is a major red flag, indicating potential for remote code execution if exploited. Furthermore, a substantial portion of its output (72%) is not properly escaped, creating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The lack of prepared statements for all SQL queries also introduces the possibility of SQL injection attacks.

The taint analysis, while reporting no critical or high severity flows, does indicate four flows with unsanitized paths. This, combined with the unprotected AJAX handlers and the inherent risks of dangerous functions, suggests that attackers could potentially leverage these weaknesses to manipulate plugin behavior or execute arbitrary code. The plugin's vulnerability history, showing one medium severity CVE related to XSS, reinforces the concern about improper input neutralization and suggests a pattern of past security weaknesses that require careful monitoring.

Overall, the plugin has a notable attack surface with three unprotected AJAX handlers, which is a direct entry point for potential abuse. The combination of unescaped output, lack of SQL sanitization, dangerous function usage, and unprotected entry points significantly elevates the risk profile. While it's positive that there are no currently unpatched CVEs and the vulnerability history is not extensive, the static analysis findings warrant significant caution and a strong recommendation for patching and enhanced security measures.