PriceWise – Measurement Price Calculator & Price by Formula for WooCommerce Security & Risk Analysis

The plugin "pricewise-calculator-pro" v1.0.0 exhibits a mixed security posture. While it demonstrates strong practices in areas like SQL query preparation and output escaping, the significant number of unprotected AJAX handlers presents a substantial risk. The code analysis reveals a large attack surface with 26 AJAX handlers, of which 24 lack proper authentication checks. This is a critical concern as it potentially allows unauthorized users to trigger plugin functionality, leading to unintended consequences or exploitation.

Furthermore, the taint analysis highlights 7 high-severity flows with unsanitized paths. This indicates potential vulnerabilities where user-supplied data could be used in unintended ways, possibly leading to command injection, file inclusion, or other critical security issues if these paths are not properly validated and sanitized. Despite a clean vulnerability history with no recorded CVEs, the presence of these high-severity taint flows and the large number of unprotected entry points suggest that the plugin is not as secure as its CVE record might imply. The plugin needs immediate attention to secure its AJAX endpoints and address the identified high-severity taint flows to mitigate significant risks.