WC Recurring Invoice Security & Risk Analysis

The "wc-invoice-pdf" v1.7.3 plugin exhibits a concerning security posture due to several critical findings in its static analysis. The presence of 3 AJAX handlers without authentication checks represents a significant attack surface, allowing potentially unauthorized actions. Furthermore, the taint analysis reveals 2 high-severity flows with unsanitized paths, indicating potential vulnerabilities that could be exploited. The plugin also utilizes dangerous functions such as "unserialize" and "exec," which, when combined with unsanitized input, can lead to severe security risks like remote code execution. Despite having no recorded CVEs, the internal code quality issues, particularly the high number of unsanitized taint flows and unprotected AJAX endpoints, overshadow this positive history. The plugin demonstrates some good practices like a high percentage of prepared SQL statements and a reasonable number of output escapes. However, the identified risks in the attack surface and taint analysis, coupled with the use of dangerous functions, necessitate immediate attention and remediation to secure its deployed instances.