FunnelKit – Funnel Builder for WooCommerce Checkout Security & Risk Analysis

The 'funnel-builder' plugin v3.14.0 presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of prepared SQL statements and proper output escaping, significant concerns remain. The plugin has a substantial attack surface, with 13 out of 37 entry points lacking proper authorization checks. This is exacerbated by a critical taint flow identified during analysis, indicating potential for serious security breaches if not addressed. The plugin's history of 12 CVEs, including a past critical vulnerability and several high-severity issues, highlights a pattern of past security weaknesses that demand vigilance. Although no currently unpatched CVEs are listed, the historical prevalence of common vulnerability types like SQL injection, file inclusion, and cross-site scripting suggests a recurring need for rigorous security auditing and timely patching. The large number of unprotected entry points and the critical taint flow are the most pressing issues that require immediate attention, outweighing the positive aspects of its code hygiene for the current version. The plugin has a history of critical vulnerabilities, and the presence of a critical taint flow in this version combined with numerous unprotected entry points suggests a moderate to high risk. While strengths like prepared statements are noted, the ongoing potential for exploitation due to unprotected handlers and past issues cannot be overlooked.