Shopper – Affiliate Link Management, 25000+ Brand Partnerships & Creative Product Displays Security & Risk Analysis

The "shopper" v3.2.8 plugin presents a mixed security posture, with several positive indicators but significant concerns regarding its attack surface. While the plugin demonstrates good practices in its handling of SQL queries and output escaping, with a high percentage of prepared statements and properly escaped outputs, its vulnerability history and the absence of authentication checks on numerous entry points are substantial weaknesses.

The static analysis reveals a concerningly large attack surface, with all 10 identified REST API routes lacking permission callbacks. This means any user, regardless of their role or privileges, could potentially interact with these endpoints, opening them up to unauthorized access and manipulation. The fact that there are no AJAX handlers or shortcodes, while positive, does little to mitigate the risk posed by the unprotected REST API routes.

The plugin's vulnerability history, specifically a past high-severity SQL injection vulnerability, combined with the large number of unprotected REST API routes, suggests a recurring pattern of insecure handling of user-supplied data. Although the current version shows a high rate of prepared statements, the historical precedent and the lack of authorization checks on REST API routes warrant significant caution. While the plugin excels in its internal code hygiene for SQL and output, the external facing attack surface remains a critical concern.