Premmerce Security & Risk Analysis

The Premmerce plugin v1.3.22 presents a mixed security posture. While it demonstrates good practices in SQL query handling with 100% prepared statements and a high rate of output escaping, significant concerns arise from its attack surface and vulnerability history. The presence of two AJAX handlers without authentication checks creates a direct entry point for unauthorized actions. Taint analysis, though showing no critical or high severity unsanitized flows, still indicates six flows with unsanitized paths, suggesting potential for vulnerabilities if not handled carefully in future updates. The plugin's history of four known CVEs, including a high severity cross-site scripting (XSS) vulnerability and PHP remote file inclusion (RFI) issues, is a significant red flag. The recentness of the last reported vulnerability (2026-02-06) is also concerning, indicating ongoing issues. The combination of an exposed attack surface and past critical vulnerability types points to a need for heightened vigilance.