Virtual Try-On for WooCommerce – Preview AI Security & Risk Analysis

The "preview-ai" v1.3.2 plugin exhibits a concerning security posture primarily due to a large number of unprotected AJAX handlers, presenting a significant attack surface. While the plugin demonstrates good practices in SQL query preparation and output escaping, the lack of authentication on most entry points is a critical weakness. The taint analysis, though limited in scope, did not reveal critical or high-severity unsanitized flows, and the absence of any recorded vulnerabilities in its history is a positive indicator of past security diligence. However, the current state, with 15 out of 16 entry points lacking authentication, poses a substantial risk that could be exploited if any of these handlers are susceptible to malicious input. The plugin has strengths in its code hygiene for SQL and output, but this is overshadowed by the fundamental flaw in its access control for its AJAX endpoints. Developers should prioritize implementing proper authentication and capability checks for all AJAX handlers to mitigate this risk.