Simple Points and Rewards for WooCommerce – Create a Loyalty Program Security & Risk Analysis

The "simple-points-and-rewards" plugin v1.10.0 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries, a high percentage of properly escaped output, and a robust number of nonce and capability checks. The absence of known vulnerabilities and dangerous functions in its history is also a significant strength. However, a notable concern arises from the static analysis revealing 30 AJAX handlers, with one handler lacking authentication checks. Furthermore, the taint analysis identified 6 high-severity flows with unsanitized paths, which could potentially be exploited if an attacker can control the input to these flows. While the vulnerability history is clean, the presence of these specific code signals warrants attention. The plugin's overall security is reasonably good due to strong SQL and output handling, but the unprotected AJAX handler and high-severity unsanitized taint flows represent the primary areas of risk.