Convesio Convert – WooCommerce Email Marketing Automation with Website Personalization, Popups and Forms Security & Risk Analysis

The "marketing-automation-and-personalization" plugin v3.3.0 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong practices in output escaping, with 100% of outputs being properly escaped, and a good percentage of SQL queries utilizing prepared statements. The absence of known CVEs and a history of unpatched vulnerabilities is also a significant strength, suggesting a generally well-maintained codebase.

However, significant concerns arise from the attack surface. A substantial 8 out of 10 AJAX handlers lack authentication checks, creating a broad entry point for potential unauthorized actions. While taint analysis shows no critical or high-severity unsanitized paths, the presence of 5 flows with unsanitized paths, even if of lower severity, warrants attention as they could potentially be exploited in conjunction with other vulnerabilities.

In conclusion, while the plugin has a clean vulnerability history and good output escaping, the lack of authentication on a majority of its AJAX endpoints presents a notable security weakness. This balance of strengths and weaknesses indicates a need for immediate attention to the unprotected AJAX handlers to improve the plugin's overall security.