Primer MyData for Woocommerce Security & Risk Analysis

The 'primer-mydata' plugin v4.3.0 exhibits a concerning security posture due to a large number of unprotected entry points. With 34 out of 38 total entry points lacking authentication checks, the plugin presents a significant attack surface. While the plugin demonstrates good practices in using prepared statements for SQL queries (56%) and proper output escaping (86%), the high number of unauthenticated AJAX handlers is a critical weakness. The taint analysis revealing two high-severity flows with unsanitized paths is particularly worrying, suggesting potential for path traversal vulnerabilities.

The vulnerability history of this plugin is also a point of concern. Although there are currently no unpatched CVEs, the presence of four historical medium-severity vulnerabilities, including path traversal, CSRF, and XSS, indicates a recurring pattern of insecure coding practices. The last reported vulnerability in 2026 also raises questions about the plugin's maintenance and update cadence. The combination of a large, exposed attack surface and past vulnerabilities suggests a high likelihood of future security issues if not addressed.

In conclusion, while the plugin shows some positive aspects like well-escaped output and prepared SQL statements, these strengths are overshadowed by the significant risks posed by its numerous unprotected entry points and the history of exploitable vulnerabilities. The high-severity taint flows are a red flag that requires immediate attention. The plugin's overall security is compromised by these factors, and users should exercise extreme caution.