Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization Security & Risk Analysis

The Nelio AB Testing plugin, version 8.2.8, exhibits a mixed security posture. While it demonstrates good practices in SQL query handling with 100% prepared statements and a high percentage of properly escaped outputs (89%), several significant concerns emerge. The plugin presents a substantial attack surface with 5 unprotected AJAX handlers, indicating potential entry points for attackers to exploit without proper authentication or authorization. Furthermore, the static analysis revealed two taint flows with unsanitized paths, both flagged as high severity. This suggests a risk of sensitive data exposure or unauthorized actions if these paths are manipulated by malicious actors. The plugin's vulnerability history is also a notable area of concern. With 6 known CVEs in total, and historically significant high and medium severity vulnerabilities such as SQL Injection, Code Injection, CSRF, SSRF, and Path Traversal, this indicates a pattern of recurring security weaknesses. Although there are currently no unpatched vulnerabilities, the past prevalence of these types of issues warrants careful monitoring and a proactive approach to security updates.