WC Product Tabs Plus Security & Risk Analysis

The plugin "wc-product-tabs-plus" v1.1.1 presents a concerning security posture primarily due to its unprotected entry points. With 2 AJAX handlers identified and both lacking authentication checks, this creates a significant attack surface. While the static analysis did not reveal dangerous functions or critical taint flows, the absence of proper authorization on AJAX actions is a major weakness that could allow unauthorized users to trigger plugin functionality. The reliance on raw SQL queries without prepared statements and a low percentage of properly escaped output further exacerbate these risks, potentially leading to SQL injection or cross-site scripting (XSS) vulnerabilities, respectively. The vulnerability history showing no known CVEs is a positive indicator, suggesting the plugin may not have been a frequent target or has a history of being developed with some security awareness. However, this should not overshadow the immediate risks identified in the code analysis.