Grow by Tradedoubler – Advertiser Plugin for WooCommerce Security & Risk Analysis

The "tradedoubler-affiliate-tracker" plugin v2.0.23 presents a mixed security posture. On the positive side, the plugin demonstrates strong adherence to secure coding practices by ensuring all SQL queries use prepared statements and all output is properly escaped. The absence of critical or high-severity taint analysis findings is also a good sign. However, significant concerns arise from the attack surface and its vulnerability history.

The plugin exposes a single AJAX handler that lacks authentication checks, creating a direct entry point for potential attackers. This is compounded by a history that includes a past critical vulnerability classified as PHP Remote File Inclusion. While currently unpatched CVEs are zero, the nature of the past critical vulnerability suggests a potential for severe impact if similar weaknesses were to be re-introduced or if this existing unprotected AJAX endpoint could be leveraged in conjunction with other, as yet undiscovered, flaws.

In conclusion, while the code exhibits good practices in data handling and output, the unprotected AJAX endpoint and the historical presence of a critical RFI vulnerability represent significant security risks that require immediate attention. The plugin has strengths in its query and output sanitization but fundamental weaknesses in access control for its entry points.