ShopPress – Shop Builder for Elementor and WooCommerce Security & Risk Analysis

The shop-press plugin version 1.5.0 demonstrates a mixed security posture. On the positive side, the plugin has a clean vulnerability history with no recorded CVEs, suggesting good past security practices or limited exposure. The absence of dangerous functions and the exclusive use of prepared statements for SQL queries are strong indicators of responsible coding. However, significant concerns arise from the static analysis, particularly regarding the attack surface. A substantial portion of AJAX handlers (2 out of 16) and all REST API routes (11 out of 11) lack proper authentication or permission checks, creating a considerable risk of unauthorized actions. While taint analysis found no critical or high-severity issues with unsanitized paths, the lack of input validation on numerous entry points could still lead to vulnerabilities like Cross-Site Scripting (XSS) or other injection attacks if combined with malicious input.