Product Addons and Product Options With Custom Fields – WowAddons Security & Risk Analysis

The "product-addons" v1.6.2 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices with a high percentage of properly escaped output, a good rate of prepared SQL statements, and a reasonable number of nonce and capability checks. The absence of critical or high-severity taint flows, dangerous functions, and critical/high CVEs is also reassuring. However, significant concerns arise from its attack surface and historical vulnerability data. The presence of an unprotected AJAX handler is a critical security gap that could allow unauthorized actions. Furthermore, the plugin has a known unpatched medium-severity vulnerability, indicating a potential ongoing risk that has not been addressed by the developers. The pattern of past vulnerabilities, specifically mentioning "Missing Authorization," suggests a recurring weakness in how the plugin handles user permissions, which, coupled with the unprotected AJAX endpoint, points to a concerning trend.