Ni WooCommerce Product Enquiry Security & Risk Analysis

The "ni-woocommerce-product-enquiry" plugin v4.1.8 presents a significant security risk due to a combination of concerning static analysis findings and a history of vulnerabilities. While the plugin demonstrates good practice by using prepared statements for SQL queries and avoiding file operations or external HTTP requests, these strengths are overshadowed by critical weaknesses. The analysis reveals a small but unprotected attack surface, with two AJAX handlers lacking any authentication or capability checks. This direct access to functionality without proper authorization is a major concern. Furthermore, the taint analysis indicates two flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited if user input is not properly handled. The plugin's vulnerability history, which includes one currently unpatched medium-severity CVE and a pattern of missing authorization vulnerabilities, strongly suggests that the developers have struggled with securing their code against authorization bypasses. This repeated issue, coupled with the current lack of authorization checks on entry points, indicates a systemic problem that needs immediate attention. The plugin has some good coding habits, but the identified security flaws, especially the unprotected AJAX handlers and the historical CVEs, place it in a precarious security posture.