PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget Security & Risk Analysis

The Pushengage plugin v4.2.1 demonstrates some good security practices, particularly its high percentage of prepared SQL statements and properly escaped outputs. The absence of known CVEs and a clean vulnerability history are positive indicators. However, the plugin has a notable attack surface with 10 AJAX handlers, 4 of which lack authentication checks. This is a significant concern as it potentially allows unauthenticated users to trigger plugin functionality. While taint analysis did not reveal critical or high-severity issues, the presence of 5 flows with unsanitized paths warrants further investigation to ensure they do not lead to exploitable vulnerabilities in conjunction with the unprotected AJAX endpoints. The plugin also has file operations and external HTTP requests, which could be vectors if not handled securely in combination with other weaknesses.