WowStore – Store Builder & Product Blocks for WooCommerce Security & Risk Analysis

The product-blocks plugin exhibits a mixed security posture. While it demonstrates strong practices in areas like SQL query sanitization and output escaping, a significant concern arises from its attack surface. A substantial number of AJAX handlers and REST API routes lack proper authorization checks, creating direct entry points for unauthenticated attackers. The taint analysis, while not revealing critical or high-severity flaws in the current version, did identify a concerning number of flows with unsanitized paths, suggesting potential for vulnerabilities if input isn't handled carefully.

The plugin's vulnerability history is a major red flag. Four previously disclosed CVEs, including a past critical vulnerability and common types like missing authorization and XSS, indicate a recurring pattern of security weaknesses. Although there are no currently unpatched CVEs, the historical trend suggests a need for ongoing vigilance and potentially more robust security development practices. The presence of past critical vulnerabilities, even if patched, necessitates a higher degree of caution.

In conclusion, the product-blocks plugin has some positive security attributes, particularly in its handling of database queries and output. However, the large number of unprotected entry points and a history of significant vulnerabilities, including critical ones and common attack vectors, present a considerable risk. The plugin requires careful review and potentially further hardening to mitigate the identified attack surface and historical security issues.