افزونه پیامک ووکامرس Persian WooCommerce SMS Security & Risk Analysis

The 'persian-woocommerce-sms' plugin v7.1.1 exhibits a mixed security posture. While it demonstrates good practices in SQL query sanitization (88% prepared statements) and output escaping (89%), several significant concerns are present. The presence of 2 unprotected AJAX handlers out of 9 total entry points is a notable risk, as it allows unauthenticated attackers to interact with these functions, potentially leading to unintended actions or information disclosure. The taint analysis reveals 2 high-severity flows with unsanitized paths, indicating potential vulnerabilities that require immediate attention. The plugin's history of 7 known CVEs, including one currently unpatched, with a focus on SQL Injection and Cross-Site Scripting, points to recurring security weaknesses in how user input is handled. The fact that the last recorded vulnerability was in 2026 suggests a proactive but potentially incomplete security development lifecycle. Overall, while some security fundamentals are in place, the combination of unprotected entry points, high-severity taint flows, and a history of exploitable vulnerabilities warrants a cautious approach.