NotifyWise – Back In Stock Notifier for WooCommerce Security & Risk Analysis

The "notifywise-back-in-stock-notifier-for-woocommerce" plugin v1.0.4 presents a concerning security posture primarily due to its extensive unprotected attack surface. With 23 AJAX handlers, none of which have authentication checks, any user, including unauthenticated ones, can trigger these functions. While the code signals indicate good practices in SQL query preparation (83% prepared) and output escaping (99% escaped), and a lack of known CVEs is positive, these strengths are overshadowed by the significant risk posed by unprotected entry points. The taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for privilege escalation or sensitive data exposure if these flows are triggered in a malicious context. Although the plugin bundles Select2, its version isn't specified, so potential vulnerabilities in this library cannot be ruled out without further inspection. The history of zero recorded vulnerabilities is a positive indicator of past secure development, but the current code's unprotected AJAX handlers represent a critical weakness that needs immediate attention.