Propovoice: All-in-One Client Management System Security & Risk Analysis

The PropoInvoice plugin version 1.7.8 exhibits a mixed security posture. While it demonstrates good practices in many areas, such as nearly all SQL queries using prepared statements and a high percentage of properly escaped output, there are significant concerns that warrant attention. The presence of 10 'unserialize' calls is a notable risk, as unserialization of untrusted data can lead to code execution vulnerabilities. Additionally, one unprotected REST API route presents a direct entry point that could be exploited without proper authentication or authorization.

The plugin's vulnerability history is concerning, with three known CVEs, one of which remains unpatched. The types of past vulnerabilities – External Control of File Name or Path, Authorization Bypass, and Cross-Site Scripting – indicate a recurring pattern of exploitable weaknesses. The fact that these vulnerabilities have occurred relatively recently, with the last one in September 2025, suggests ongoing security challenges. Despite a generally robust approach to input validation and capability checks, the combination of legacy issues and new potential attack vectors necessitates a cautious approach.

In conclusion, PropoInvoice v1.7.8 has strengths in its general adherence to secure coding principles for SQL and output handling. However, the critical 'unserialize' function usage, an unprotected REST API endpoint, and a history of serious, unpatched vulnerabilities significantly increase its risk profile. Users should be aware of these risks and prioritize updating to a version that addresses the outstanding vulnerabilities.