Country Sales Report For WooCommerce Security & Risk Analysis

The ni-country-sales-report-for-woocommerce plugin version 1.1.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and has no recorded vulnerabilities in its history, indicating a generally stable codebase. However, significant security concerns are present due to the static analysis findings. The plugin exposes one AJAX handler without any authentication or capability checks, representing a direct entry point for attackers. Furthermore, the taint analysis reveals six high-severity flows with unsanitized paths, suggesting that user-supplied data might be processed in a way that could lead to various injection attacks or unexpected behavior. The absence of nonce checks on the AJAX endpoint compounds this risk.