Oliver POS – A WooCommerce Point of Sale (POS) Security & Risk Analysis

The Oliver POS plugin version 2.4.2.6 presents a mixed security posture. While it demonstrates good practices like using prepared statements for a high percentage of SQL queries and implementing a decent number of nonce and capability checks, there are significant areas of concern. The static analysis reveals a notable attack surface with one AJAX handler lacking authentication, which is a direct entry point for potential unauthorized actions. Furthermore, the presence of the `unserialize` function is a known risk, especially if user-supplied data is involved without proper sanitization. The plugin's vulnerability history is particularly alarming, with three past CVEs including one critical and one high severity, and a recent vulnerability in February 2025. This pattern suggests a recurring security weakness and a need for more robust security development lifecycles. The taint analysis also indicates unsanitized paths, though no critical or high severity flows were found, it warrants attention. Overall, while the plugin has strengths in its handling of database queries and some security checks, the identified unprotected entry points, dangerous function usage, and a history of severe vulnerabilities necessitate a cautious approach and prompt remediation.