Profitblue – Financial reporting for WooCommerce Security & Risk Analysis

The plugin "profitblue-financial-reporting-for-woocommerce" v1.1.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices in its SQL query handling, with an overwhelming majority (99%) using prepared statements, and it has a clean vulnerability history with no recorded CVEs. The absence of external HTTP requests and a relatively low number of file operations are also strengths. However, significant concerns arise from the attack surface analysis. A substantial number of AJAX handlers (34 out of 37) lack authentication checks, creating a large potential entry point for malicious actors. Furthermore, the taint analysis reveals 23 flows with unsanitized paths, including two classified as high severity, indicating potential vulnerabilities where user-supplied data could be manipulated or lead to unintended code execution. While there are no current unpatched CVEs, the presence of high-severity taint flows suggests an internal risk that needs immediate attention. The lack of capability checks on AJAX handlers is a critical oversight. The plugin's strengths in SQL and its clean CVE history are overshadowed by the numerous unprotected AJAX endpoints and the identified taint flows.