SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster Security & Risk Analysis

The sellkit v2.4.0 plugin exhibits a mixed security posture. While it demonstrates good practices like a high percentage of prepared SQL statements and adequate nonce checks for its entry points, several concerns warrant attention. The presence of one AJAX handler without authentication checks represents a direct risk, as it could be exploited by unauthenticated users. Additionally, the use of the `unserialize` function, although not flagged in taint analysis, is a known source of vulnerabilities if not handled with extreme care and proper input sanitization. The plugin's history of two medium-severity vulnerabilities, specifically Cross-site Scripting and Path Traversal, indicates a past tendency for input validation and output escaping issues. The recency of the last vulnerability (June 5, 2024) suggests that while past issues may be patched, the underlying coding patterns might still pose a latent risk.

Overall, the plugin's substantial attack surface of 58 entry points, with one being unprotected, combined with the historical vulnerability types, indicates a need for ongoing vigilance. The high percentage of properly escaped outputs and prepared SQL queries are strengths, but the single unprotected AJAX handler and the flagged dangerous function (`unserialize`) are significant weaknesses that could be exploited. The absence of critical or high severity taint flows is a positive sign, but it does not negate the risks from the identified code signals and historical vulnerabilities.