eMagicOne Store Manager for WooCommerce Security & Risk Analysis

The "store-manager-connector" plugin v1.3.2 exhibits a mixed security posture. On the positive side, the static analysis shows a complete lack of direct entry points like AJAX handlers, REST API routes, shortcodes, and cron events that are not protected by authorization checks. Furthermore, all SQL queries utilize prepared statements, and a high percentage of output is properly escaped. The plugin also includes nonce and capability checks. However, significant concerns arise from the presence of the `unserialize` function, which is a known vector for remote code execution if used with untrusted input. Taint analysis reveals two flows with unsanitized paths, both flagged with high severity, indicating potential vulnerabilities related to file operations or path manipulation. The plugin's vulnerability history is a major red flag, with four known CVEs, including two critical and one high severity, and a recent vulnerability discovered in May 2025. The common types of past vulnerabilities (External Control of File Name or Path, Unrestricted Upload of File with Dangerous Type) directly correlate with the concerns identified in the taint analysis. While the current version appears to have no unpatched CVEs, the historical pattern suggests a recurring susceptibility to these types of attacks. In conclusion, despite good practices in input sanitization for SQL and output escaping, the identified `unserialize` function and the high-severity unsanitized paths in taint analysis, coupled with a concerning vulnerability history, necessitate caution and thorough investigation.