Ni WooCommerce Order Export Security & Risk Analysis

The ni-woocommerce-order-export plugin version 3.1.6 exhibits a concerning security posture despite some positive indicators. While the plugin utilizes prepared statements for all SQL queries and avoids file operations and external HTTP requests, significant weaknesses are present. The presence of an unprotected AJAX handler represents a direct entry point for attackers, and the lack of nonce and capability checks on this handler amplifies the risk. Furthermore, a substantial portion of output is not properly escaped, indicating a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The plugin's vulnerability history reveals a known medium severity vulnerability, specifically an XSS issue, with a recent discovery in December 2024, and crucially, this vulnerability remains unpatched. This pattern of unpatched vulnerabilities, coupled with the identified code weaknesses, suggests a plugin that may not be actively maintained or tested for security flaws, posing a significant risk to WordPress sites that utilize it.