Multiple Carts, Persistent Carts, Abandoned Carts, MultiVendors for Woo – Free by WP Masters Security & Risk Analysis

The plugin "multiple-carts-for-woo-free-by-wp-masters" v1.0.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by having all identified entry points protected by authorization checks, no unescaped output, and no file operations or external HTTP requests. The high percentage of SQL queries using prepared statements is also commendable, and the absence of any known vulnerabilities in its history suggests a generally stable codebase. However, significant concerns arise from the static analysis. The presence of the `unserialize` function, a known dangerous function, along with two taint flows identified as high severity and having unsanitized paths, presents a critical risk. These findings indicate potential for code injection or unauthorized data manipulation if the plugin handles user-supplied data that is then passed to `unserialize` without proper sanitization. The single nonce check is also insufficient for the number of potential entry points, leaving room for Cross-Site Request Forgery (CSRF) attacks.