Hide Price Until Login Security & Risk Analysis

The "hide-price-until-login" plugin v1.1.1 exhibits a concerning security posture due to a significant number of unprotected AJAX handlers, representing its entire attack surface. While the plugin demonstrates good practices in its handling of SQL queries (100% prepared statements) and avoids dangerous functions, these strengths are overshadowed by the lack of authentication checks on all its entry points.

The static analysis reveals that all 7 AJAX handlers lack authentication. This means any unauthenticated user could potentially trigger these handlers, opening up possibilities for various attacks if the handlers perform sensitive actions or expose information. The taint analysis, while not revealing critical or high severity flows, does indicate 4 flows with unsanitized paths, which, combined with the unprotected AJAX handlers, represents a significant risk. The external HTTP request also warrants attention, as it could be a vector for further compromise if not handled securely.

The vulnerability history of this plugin is notably clean, with no recorded CVEs. This absence of past vulnerabilities is positive, suggesting a historical tendency towards secure coding. However, the current code analysis reveals immediate and substantial risks that are not mitigated by past performance. The plugin's overall security is weakened by its extensive unprotected attack surface, despite its good SQL practices and lack of past vulnerabilities.