Supplier Order Email Security & Risk Analysis

The "supplier-order-email" plugin v3.6.15 exhibits a mixed security posture. On the positive side, the plugin has a remarkably small attack surface with zero identified entry points that lack authentication or permission checks. This suggests a good understanding of WordPress security best practices regarding direct user interaction vectors. The plugin also demonstrates a relatively strong output escaping rate and includes nonce and capability checks in its code.

However, significant concerns arise from the handling of SQL queries. With 12 total SQL queries and 0% utilizing prepared statements, the plugin is highly susceptible to SQL injection vulnerabilities. Furthermore, the taint analysis reveals two flows with unsanitized paths, indicating potential risks even if no critical or high-severity issues were flagged in this specific analysis. The presence of the "dompdf" library is also noted; while not inherently a vulnerability, bundled libraries can become a risk if not actively maintained and updated, as they can contain their own vulnerabilities.

Critically, the plugin's vulnerability history is spotless, with zero known CVEs. This is a very positive sign, suggesting a history of stable and secure development. However, this lack of history does not negate the clear risks identified in the static and taint analysis. The absence of vulnerabilities could be due to a lack of past targeted analysis or simply good luck, rather than inherent security. Therefore, while the plugin benefits from a clean history and a protected attack surface, the widespread lack of prepared statements in SQL queries and the identified unsanitized paths present a substantial risk that requires immediate attention.