MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Security & Risk Analysis

wordpress.org/plugins/mipl-wc-multisite-sync

Synchronize products, stock, orders, customers, coupons and reviews seamlessly across multiple WooCommerce stores.

200 active installs v1.4.1 PHP 7.4+ WP 5.1+ Updated Mar 12, 2026
ordersproductssyncsynchronizationwoocommerce
98
A · Safe
CVEs total1
Unpatched0
Last CVEJan 6, 2025
Safety Verdict

Is MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Safe to Use in 2026?

Generally Safe

Score 98/100

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Jan 6, 2025Updated 23d ago
Risk Assessment

The mipl-wc-multisite-sync v1.4.1 plugin presents a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries and proper output escaping, significant concerns arise from its attack surface. All 8 REST API routes lack permission callbacks, creating a substantial vulnerability for unauthorized access and manipulation. The taint analysis also identified two flows with unsanitized paths, although they were not classified as critical or high severity, this still indicates a potential for path traversal issues that should be addressed.

The plugin's vulnerability history shows one known high-severity CVE related to Path Traversal. Although this vulnerability is currently patched, the historical presence of such an issue, combined with the taint analysis results, suggests that path handling within the plugin might be an area requiring ongoing scrutiny. The use of a bundled library (Select2) is noted, but its version is not specified, which could be a minor concern if it's outdated.

In conclusion, the plugin has strengths in its database and output handling. However, the unprotected REST API endpoints are a critical weakness that exposes the plugin to significant risk. The historical path traversal vulnerability, even if patched, along with the taint analysis findings, warrants careful monitoring and potential refactoring of path-related logic.

Key Concerns

  • All REST API routes lack permission callbacks
  • Taint analysis found unsanitized paths
  • One historical high severity CVE (Path Traversal)
Vulnerabilities
1

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Security Vulnerabilities

CVEs by Year

1 CVE in 2025
2025
Patched Has unpatched

Severity Breakdown

High
1

1 total CVE

CVE-2024-12152high · 7.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download

Jan 6, 2025 Patched in 1.1.6 (1d)
Code Analysis
Analyzed Mar 16, 2026

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Code Analysis

Dangerous Functions
0
Raw SQL Queries
5
20 prepared
Unescaped Output
81
384 escaped
Nonce Checks
6
Capability Checks
2
File Operations
0
External Requests
9
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

80% prepared25 total queries

Output Escaping

83% escaped465 total outputs
Data Flows
2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths
mipl_wc_sync_save_site_settings (include\mipl-wc-sync-sku-addon.php:82)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
8 unprotected

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Attack Surface

Entry Points8
Unprotected8

REST API Routes 8

GETPOSTPUTDELETE/wp-json/mipl-wc-sync/v1/webhook/include\class-mipl-wc-sync-core.php:236
GETPOSTPUTDELETE/wp-json/mipl-wc-sync-pro/v1/webhook/include\class-mipl-wc-sync-core.php:242
GETPOSTPUTDELETE/wp-json/mipl-wc-sync/v1/wc_auth_subsite_callback_url/include\class-mipl-wc-sync-core.php:248
GETPOSTPUTDELETE/wp-json/mipl-wc-sync/v1/check_plugin/include\class-mipl-wc-sync-core.php:254
GETPOST/wp-json/mipl-wc-sync/v1/fetch-product-sync-data/include\class-mipl-wc-sync-core.php:260
POST/wp-json/mipl-wc-sync/v1/manually_sync/include\class-mipl-wc-sync-core.php:266
GETPOST/wp-json/mipl-wc-sync/v1/sync-status/include\class-mipl-wc-sync-core.php:272
POST/wp-json/mipl-wc-sync/v1/resync_orders/include\class-mipl-wc-sync-core.php:278
WordPress Hooks 153
actionadmin_noticesinclude\class-mipl-wc-sync-core.php:192
actionrest_api_initinclude\class-mipl-wc-sync-core.php:234
actionadmin_initinclude\class-mipl-wc-sync-core.php:287
filterwoocommerce_email_recipient_cancelled_orderinclude\class-mipl-wc-sync-core.php:290
filterwoocommerce_email_recipient_failed_orderinclude\class-mipl-wc-sync-core.php:291
filterwoocommerce_email_recipient_customer_refunded_orderinclude\class-mipl-wc-sync-core.php:292
filterwoocommerce_email_recipient_customer_partially_refunded_orderinclude\class-mipl-wc-sync-core.php:293
filterwoocommerce_email_recipient_backorderinclude\class-mipl-wc-sync-core.php:294
filterwoocommerce_email_recipient_low_stockinclude\class-mipl-wc-sync-core.php:295
filterwoocommerce_email_recipient_no_stockinclude\class-mipl-wc-sync-core.php:296
filterwoocommerce_email_recipient_customer_on_hold_orderinclude\class-mipl-wc-sync-core.php:297
filterwoocommerce_email_recipient_customer_completed_orderinclude\class-mipl-wc-sync-core.php:298
filterwoocommerce_email_recipient_customer_invoiceinclude\class-mipl-wc-sync-core.php:299
filterwoocommerce_email_recipient_customer_processing_orderinclude\class-mipl-wc-sync-core.php:300
filterwoocommerce_email_recipient_customer_noteinclude\class-mipl-wc-sync-core.php:301
filtercron_schedulesinclude\class-mipl-wc-sync-core.php:304
actionmipl_wc_sync_delete_auto_logsinclude\class-mipl-wc-sync-core.php:307
actionmipl_wc_sync_delete_order_logsinclude\class-mipl-wc-sync-core.php:313
actionwoocommerce_product_duplicateinclude\class-mipl-wc-sync-core.php:319
filterhttp_request_argsinclude\class-mipl-wc-sync-core.php:322
actionpre_get_postsinclude\class-mipl-wc-sync-core.php:327
actionrestrict_manage_postsinclude\class-mipl-wc-sync-core.php:330
actionadmin_headinclude\class-mipl-wc-sync-core.php:333
actionadmin_noticesinclude\class-mipl-wc-sync-core.php:336
actionadmin_initinclude\class-mipl-wc-sync-core.php:339
actionadmin_initinclude\class-mipl-wc-sync-core.php:342
actionadmin_initinclude\class-mipl-wc-sync-core.php:345
actionadmin_footerinclude\class-mipl-wc-sync-core.php:348
actionadd_meta_boxesinclude\class-mipl-wc-sync-core.php:351
actionadmin_menuinclude\class-mipl-wc-sync-core.php:354
filterplugin_action_linksinclude\class-mipl-wc-sync-core.php:357
actionthe_titleinclude\class-mipl-wc-sync-core.php:360
actionthe_titleinclude\class-mipl-wc-sync-core.php:363
filtermanage_users_columnsinclude\class-mipl-wc-sync-core.php:366
filtermanage_users_custom_columninclude\class-mipl-wc-sync-core.php:369
actionedit_user_profileinclude\class-mipl-wc-sync-core.php:372
filtermanage_edit-product_columnsinclude\class-mipl-wc-sync-core.php:375
filterbulk_actions-edit-productinclude\class-mipl-wc-sync-core.php:378
actionmanage_product_posts_custom_columninclude\class-mipl-wc-sync-core.php:381
actionhandle_bulk_actions-edit-productinclude\class-mipl-wc-sync-core.php:384
actionadmin_head-edit.phpinclude\class-mipl-wc-sync-core.php:387
actionadmin_footerinclude\class-mipl-wc-sync-core.php:390
actionadmin_initinclude\class-mipl-wc-sync-core.php:393
actionadmin_footerinclude\class-mipl-wc-sync-core.php:396
actionadmin_footerinclude\class-mipl-wc-sync-core.php:399
actionadmin_footerinclude\class-mipl-wc-sync-core.php:402
actionadmin_footerinclude\class-mipl-wc-sync-core.php:405
actionwoocommerce_settings_save_generalinclude\class-mipl-wc-sync-core.php:408
actionwoocommerce_settings_save_taxinclude\class-mipl-wc-sync-core.php:409
actionwoocommerce_settings_save_productsinclude\class-mipl-wc-sync-core.php:410
actionwoocommerce_new_productinclude\class-mipl-wc-sync-core.php:413
actionwoocommerce_update_productinclude\class-mipl-wc-sync-core.php:414
actionwoocommerce_update_productinclude\class-mipl-wc-sync-core.php:417
actionadmin_footerinclude\class-mipl-wc-sync-core.php:420
actionadmin_footerinclude\class-mipl-wc-sync-core.php:421
actionadmin_footerinclude\class-mipl-wc-sync-core.php:422
filtermanage_edit-product_cat_columnsinclude\class-mipl-wc-sync-core.php:425
filtermanage_edit-product_brand_columnsinclude\class-mipl-wc-sync-core.php:428
actionmanage_product_cat_custom_columninclude\class-mipl-wc-sync-core.php:431
actionmanage_product_brand_custom_columninclude\class-mipl-wc-sync-core.php:434
actionproduct_cat_row_actionsinclude\class-mipl-wc-sync-core.php:437
actionproduct_brand_row_actionsinclude\class-mipl-wc-sync-core.php:440
filterbulk_actions-edit-product_catinclude\class-mipl-wc-sync-core.php:443
filterbulk_actions-edit-product_brandinclude\class-mipl-wc-sync-core.php:446
actionpre_delete_terminclude\class-mipl-wc-sync-core.php:460
actionbefore_delete_postinclude\class-mipl-wc-sync-core.php:463
actiontrashed_postinclude\class-mipl-wc-sync-core.php:464
actionadmin_footerinclude\class-mipl-wc-sync-core.php:467
actiontrashed_commentinclude\class-mipl-wc-sync-core.php:470
actionspammed_commentinclude\class-mipl-wc-sync-core.php:471
actionadmin_footerinclude\class-mipl-wc-sync-core.php:477
actionadmin_initinclude\class-mipl-wc-sync-core.php:480
actionadmin_footerinclude\class-mipl-wc-sync-core.php:483
filterpost_row_actionsinclude\class-mipl-wc-sync-core.php:489
actiontrashed_postinclude\class-mipl-wc-sync-core.php:492
actionuntrash_postinclude\class-mipl-wc-sync-core.php:495
actionadmin_footerinclude\class-mipl-wc-sync-core.php:512
actioninitinclude\class-mipl-wc-sync-core.php:515
actionadmin_initinclude\class-mipl-wc-sync-core.php:522
actionadmin_initinclude\class-mipl-wc-sync-core.php:527
actionadmin_initinclude\class-mipl-wc-sync-core.php:532
actionadmin_initinclude\class-mipl-wc-sync-core.php:537
actionadmin_initinclude\class-mipl-wc-sync-core.php:542
actionwoocommerce_initinclude\class-mipl-wc-sync-core.php:547
actionadmin_initinclude\class-mipl-wc-sync-core.php:561
actionadmin_initinclude\class-mipl-wc-sync-core.php:566
actionadmin_initinclude\class-mipl-wc-sync-core.php:571
actionadmin_initinclude\class-mipl-wc-sync-core.php:576
actionadmin_initinclude\class-mipl-wc-sync-core.php:581
actionadmin_initinclude\class-mipl-wc-sync-core.php:586
actionadmin_initinclude\class-mipl-wc-sync-core.php:591
actionadmin_initinclude\class-mipl-wc-sync-core.php:596
actionadmin_initinclude\class-mipl-wc-sync-core.php:601
actionadmin_initinclude\class-mipl-wc-sync-core.php:606
actionadmin_initinclude\class-mipl-wc-sync-core.php:611
actionadmin_initinclude\class-mipl-wc-sync-core.php:616
actionadmin_initinclude\class-mipl-wc-sync-core.php:621
actionadmin_initinclude\class-mipl-wc-sync-core.php:626
actionadmin_initinclude\class-mipl-wc-sync-core.php:631
filterpost_row_actionsinclude\class-mipl-wc-sync-core.php:636
actionadmin_initinclude\class-mipl-wc-sync-core.php:639
filterpost_row_actionsinclude\class-mipl-wc-sync-core.php:642
actionadmin_initinclude\class-mipl-wc-sync-core.php:649
actionadmin_initinclude\class-mipl-wc-sync-core.php:652
actionadmin_initinclude\class-mipl-wc-sync-core.php:657
actionadmin_initinclude\class-mipl-wc-sync-core.php:661
actionadmin_initinclude\class-mipl-wc-sync-core.php:665
actionadmin_initinclude\class-mipl-wc-sync-core.php:669
actionwoocommerce_order_status_changedinclude\class-mipl-wc-sync-core.php:673
actionadmin_initinclude\class-mipl-wc-sync-core.php:677
actionadmin_initinclude\class-mipl-wc-sync-core.php:682
actionadmin_initinclude\class-mipl-wc-sync-core.php:687
actionadmin_initinclude\class-mipl-wc-sync-core.php:692
actionadmin_initinclude\class-mipl-wc-sync-core.php:696
actionadmin_initinclude\class-mipl-wc-sync-core.php:701
actionadmin_initinclude\class-mipl-wc-sync-core.php:706
actionadmin_initinclude\class-mipl-wc-sync-core.php:710
actionadmin_initinclude\class-mipl-wc-sync-core.php:714
actionadmin_initinclude\class-mipl-wc-sync-core.php:718
actionadmin_initinclude\class-mipl-wc-sync-core.php:722
actionedit_commentinclude\class-mipl-wc-sync-core.php:728
actioncomment_postinclude\class-mipl-wc-sync-core.php:729
actionwoocommerce_process_shop_order_metainclude\class-mipl-wc-sync-core.php:733
actionwoocommerce_checkout_initinclude\class-mipl-wc-sync-core.php:735
actionwoocommerce_reduce_order_stockinclude\class-mipl-wc-sync-core.php:736
actionwoocommerce_order_status_changedinclude\class-mipl-wc-sync-core.php:739
actionwoocommerce_restore_order_stockinclude\class-mipl-wc-sync-core.php:740
actionmipl_wc_sync_product_sync_m2sinclude\class-mipl-wc-sync-core.php:743
actionmipl_wc_sync_product_sync_s2minclude\class-mipl-wc-sync-core.php:748
actionmipl_wc_sync_order_sync_s2minclude\class-mipl-wc-sync-core.php:753
actioncurrent_screeninclude\class-mipl-wc-sync-core.php:759
filterwoocommerce_shop_order_list_table_columnsinclude\class-mipl-wc-sync-core.php:904
actionmanage_woocommerce_page_wc-orders_custom_columninclude\class-mipl-wc-sync-core.php:905
filtermanage_edit-shop_order_columnsinclude\class-mipl-wc-sync-core.php:907
actionmanage_shop_order_posts_custom_columninclude\class-mipl-wc-sync-core.php:908
filterwoocommerce_rest_check_permissionsinclude\class-mipl-wc-sync-customers.php:94
filterwoocommerce_email_enabled_new_orderinclude\class-mipl-wc-sync-orders.php:469
filterwoocommerce_email_recipient_customer_on_hold_orderinclude\class-mipl-wc-sync-orders.php:470
filterwoocommerce_email_recipient_customer_processing_orderinclude\class-mipl-wc-sync-orders.php:471
filterwoocommerce_email_recipient_customer_on_hold_orderinclude\class-mipl-wc-sync-orders.php:760
filterwoocommerce_email_recipient_customer_processing_orderinclude\class-mipl-wc-sync-orders.php:761
filterwoocommerce_prevent_adjust_line_item_product_stockinclude\class-mipl-wc-sync-orders.php:1397
filterwoocommerce_rest_check_permissionsinclude\class-mipl-wc-sync-orders.php:1745
filterwoocommerce_email_enabled_new_orderinclude\class-mipl-wc-sync-orders.php:1747
filterwoocommerce_email_recipient_customer_on_hold_orderinclude\class-mipl-wc-sync-orders.php:1748
filterwoocommerce_email_recipient_customer_processing_orderinclude\class-mipl-wc-sync-orders.php:1749
actioninitinclude\mipl-wc-sync-sku-addon.php:3
actioninitinclude\mipl-wc-sync-sku-addon.php:9
actionmipl_wc_sync_save_sku_settingsinclude\mipl-wc-sync-sku-addon.php:81
filtermipl_wc_sync_apply_sku_m2sinclude\mipl-wc-sync-sku-addon.php:100
filtermipl_wc_sync_apply_sku_s2minclude\mipl-wc-sync-sku-addon.php:128
actionplugins_loadedmipl-wc-multisite-sync.php:48
actionupgrader_process_completemipl-wc-multisite-sync.php:54

Scheduled Events 5

mipl_wc_sync_delete_auto_logs
mipl_wc_sync_delete_order_logs
mipl_wc_sync_product_sync_m2s
mipl_wc_sync_product_sync_s2m
mipl_wc_sync_order_sync_s2m
Maintenance & Trust

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 12, 2026
PHP min version7.4
Downloads7K

Community Trust

Rating88/100
Number of ratings7
Active installs200
Developer Profile

MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders. Developer Profile

Mulika Team

6 plugins · 280 total installs

100
trust score
Avg Security Score
100/100
Avg Patch Time
1 days
View full developer profile
Detection Fingerprints

How We Detect MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders.

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/mipl-wc-multisite-sync/assets/css/backend.css/wp-content/plugins/mipl-wc-multisite-sync/assets/js/backend.js/wp-content/plugins/mipl-wc-multisite-sync/assets/js/frontend.js
Script Paths
/wp-content/plugins/mipl-wc-multisite-sync/assets/js/backend.js/wp-content/plugins/mipl-wc-multisite-sync/assets/js/frontend.js
Version Parameters
mipl-wc-multisite-sync/assets/css/backend.css?ver=mipl-wc-multisite-sync/assets/js/backend.js?ver=mipl-wc-multisite-sync/assets/js/frontend.js?ver=

HTML / DOM Fingerprints

CSS Classes
mipl-wc-sync-product-tabmipl-wc-sync-order-tabmipl-wc-sync-coupon-tabmipl-wc-sync-customer-tabmipl-wc-sync-settings-tabmipl-wc-sync-sync-log-tabmipl-wc-sync-license-tab
HTML Comments
<!-- MIPL WC SYNC START --><!-- MIPL WC SYNC END --><!-- MIPL WC SYNC PRODUCT SYNC TAB --><!-- MIPL WC SYNC ORDER SYNC TAB -->+5 more
Data Attributes
data-mipl-wc-sync-tab
JS Globals
mipl_wc_sync_object
FAQ

Frequently Asked Questions about MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders.