Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification Security & Risk Analysis

The wc-blacklist-manager plugin v2.1.8 exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL query sanitization, with 93% using prepared statements, and a substantial number of nonce and capability checks, indicating an effort to secure certain operations. The plugin also has no recorded vulnerability history, which suggests a degree of stability and potentially good security practices over time. However, significant concerns arise from its attack surface and taint analysis. The presence of four unprotected entry points (two AJAX handlers and two REST API routes without permission callbacks) presents a clear vulnerability to unauthorized access and potential manipulation. Furthermore, the taint analysis revealing 14 high-severity flows with unsanitized paths is a critical finding. These unsanitized paths, especially when combined with unprotected entry points, strongly suggest the potential for code injection, cross-site scripting (XSS), or other severe vulnerabilities, despite the absence of publicly known CVEs. The moderate percentage of properly escaped output (63%) also introduces a risk of XSS attacks.