Gou Manage My Account Menu – User Roles Security & Risk Analysis

The "gou-wc-account-tabs" plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for all SQL queries and ensuring a high percentage of output is properly escaped. The absence of dangerous functions, file operations, and external HTTP requests further strengthens its security. However, significant concerns arise from its attack surface. With seven AJAX handlers, two of which lack authentication checks, there's a clear potential for unauthorized actions to be performed. While no critical or high-severity taint flows were detected, the presence of missing authorization checks on AJAX endpoints is a direct pathway for exploitation. The vulnerability history, with one medium-severity CVE related to missing authorization, reinforces this concern and suggests a recurring pattern of weak access control in the plugin. Overall, while the plugin implements good coding practices in some areas, the unprotected AJAX endpoints represent a critical weakness that needs immediate attention.