ShopMetrics for WooCommerce Security & Risk Analysis

The 'shopmetrics' v1.0.10 plugin exhibits a mixed security posture. On the positive side, the plugin has a clean vulnerability history with no recorded CVEs, which is a strong indicator of good development practices and diligence in addressing security issues. The taint analysis also shows no critical or high severity flows with unsanitized paths, suggesting that common injection vulnerabilities are likely mitigated. However, the static analysis reveals significant areas for concern. The presence of 33 AJAX handlers, with one entirely lacking authentication checks, presents a direct and exploitable attack vector. Furthermore, the static analysis indicates that 100% of SQL queries are executed without prepared statements, a critical deficiency that makes the plugin highly susceptible to SQL injection attacks. While the plugin has a good history and no critical taint flows, these two static analysis findings introduce substantial risks that cannot be overlooked.