Shopready – Elementor addons for WooCommerce Page Builder Security & Risk Analysis

The "shopready-elementor-addon" plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface and vulnerability history. A substantial number of AJAX handlers (12 out of 13) lack authentication checks, creating a wide entry point for potential unauthorized actions. The plugin also has a known high-severity vulnerability related to improper control of filename for include/require statements, which is currently unpatched. This history, coupled with the large number of unprotected AJAX endpoints, suggests a pattern of potential security oversights that require immediate attention. The presence of external HTTP requests, while not inherently a vulnerability, adds to the potential for attack vectors if not handled securely. Overall, the plugin has strengths in secure coding for database interactions but weaknesses in access control for its numerous AJAX endpoints and a critical unpatched vulnerability that elevates its risk.