WC Search Orders By Product Security & Risk Analysis

The plugin "wc-search-orders-by-product" v3.2 exhibits a mixed security posture. On the positive side, it has no recorded vulnerabilities (CVEs) and avoids dangerous functions and file operations. The majority of its SQL queries use prepared statements and most output is properly escaped, indicating an effort towards secure coding practices. However, there are notable concerns. The plugin exposes one unprotected AJAX handler, representing a significant attack vector that could be exploited without proper authentication. While the number of taint flows with unsanitized paths is low and no critical or high severity issues were found, the presence of two such flows warrants attention. The plugin also lacks capability checks on its entry points, further increasing the risk associated with the unprotected AJAX handler.