Affiliate Sales in Google Analytics and other tools Security & Risk Analysis

The "wecantrack" plugin v4.0.2 exhibits a mixed security posture. While it shows positive signs like using prepared statements for all SQL queries and performing file operations, significant concerns arise from its attack surface and output sanitization. The presence of two AJAX handlers without authentication checks presents a direct and exploitable entry point for attackers.

The taint analysis reveals a concerning four flows with unsanitized paths, indicating a potential for various vulnerabilities if these paths involve user-controlled input. Although the static analysis did not identify critical or high severity taint flows in this specific scan, the sheer number of unsanitized paths is a strong indicator of potential risk.

Historically, the plugin has had a medium-severity vulnerability classified as 'Open Redirect'. While there are currently no unpatched CVEs, the past occurrence of an Open Redirect, coupled with the current findings of unprotected AJAX endpoints and unsanitized paths, suggests a pattern of potential security weaknesses that require ongoing vigilance. The plugin's output escaping is also a weak point, with less than half of the outputs being properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities.