Text Message SMS Extension for WooCommerce Security & Risk Analysis

The plugin "text-message-sms-extension-for-woocommerce" v1.5.0 exhibits several concerning security practices that warrant careful consideration. A significant weakness lies in its attack surface, with two AJAX handlers, both lacking authentication checks. This opens the door for unauthenticated users to potentially interact with these handlers, leading to unintended actions or information disclosure. Furthermore, the plugin uses raw SQL queries without prepared statements, which, combined with potentially unsanitized input from the identified taint flow, presents a risk of SQL injection vulnerabilities. The lack of nonce and capability checks on its entry points further exacerbates these risks, as it allows for unauthorized access and execution. While the plugin has no recorded vulnerability history, this does not guarantee its current security. The absence of past CVEs could be due to its limited scope, recent development, or simply a lack of public scrutiny. The current static analysis findings, particularly the unprotected AJAX handlers and raw SQL queries, are significant indicators of potential security weaknesses that require immediate attention.