LetsRecover – WooCommerce Abandoned Cart Notifications Security & Risk Analysis

The 'letsrecover-woocommerce-abandoned-cart' plugin version 1.2.0 exhibits a concerning security posture, primarily due to a large number of unprotected AJAX endpoints. While the plugin utilizes prepared statements for most SQL queries and has a high rate of output escaping, the presence of six AJAX handlers without authentication checks presents a significant attack surface. The taint analysis further amplifies these concerns, revealing eight flows with unsanitized paths classified as high severity. The plugin's vulnerability history, which includes three past CVEs with a critical and two high-severity issues, particularly a critical SQL injection from late 2022, suggests a pattern of past exploitable weaknesses. Although there are no currently unpatched vulnerabilities, the historical trend and the current code analysis findings indicate a need for significant security improvements to mitigate potential risks.