WPS Bookings for WooCommerce Security & Risk Analysis

The mwb-bookings-for-woocommerce plugin v3.11.2 exhibits a mixed security posture. While the plugin has no recorded vulnerabilities or CVEs, indicating a potentially good track record, the static analysis reveals significant areas of concern. A substantial portion of the attack surface, specifically 10 out of 14 AJAX handlers, lacks authentication checks. This is a major vulnerability, as unauthenticated users could potentially trigger these actions, leading to unexpected behavior or further exploitation if combined with other weaknesses. Furthermore, the presence of raw SQL queries without prepared statements is a critical security flaw that could lead to SQL injection vulnerabilities. While output escaping is generally well-handled, the lack of robust authentication on AJAX endpoints and the use of raw SQL queries present significant risks that outweigh the positive aspects of its clean vulnerability history and generally good output escaping.