Flexible PDF Invoices for WooCommerce & WordPress Security & Risk Analysis

The "flexible-invoices" plugin v6.2.11 exhibits a mixed security posture. While it demonstrates a decent number of capability checks and a majority of SQL queries use prepared statements, there are significant areas of concern. The presence of three AJAX handlers without authentication checks represents a notable attack surface that could be exploited by unauthenticated users. Furthermore, the analysis reveals the use of dangerous functions like `proc_open`, `passthru`, and `unserialize`, which, if not handled with extreme care, can introduce severe vulnerabilities such as remote code execution. The taint analysis did not uncover critical or high severity flows, which is positive, but the presence of unsanitized paths is still a risk. The vulnerability history shows one medium-severity CVE, a Cross-Site Request Forgery (CSRF), which was patched. The fact that the last vulnerability was in 2025, despite being a medium severity, suggests a pattern of past issues. Overall, while the plugin isn't inherently flawed due to its SQL practices and checks, the unauthenticated entry points and the use of dangerous functions warrant caution.