LMSACE Connect – WooCommerce Moodle™ LMS Integration Security & Risk Analysis

The lmsace-connect plugin v3.4 exhibits a mixed security posture. While a high percentage of output is properly escaped and there are no identified dangerous functions or critical/high severity taint flows, significant concerns remain. The presence of unprotected AJAX handlers presents a direct attack vector, especially when combined with a lack of nonce checks and only a single capability check. The raw SQL query without prepared statements is a notable risk for SQL injection vulnerabilities. Furthermore, the plugin has a history of a medium severity vulnerability, specifically related to missing authorization, which is a recurring theme in its security record. The recent unpatched vulnerability (as of 2025-07-04) further exacerbates these concerns, indicating a potential for ongoing security weaknesses. In conclusion, while some security best practices are followed, the unprotected entry points, raw SQL, and history of authorization issues, coupled with an unpatched vulnerability, point to a moderate to high risk profile.