weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce Security & Risk Analysis

The plugin 'wemail' v2.0.14 exhibits a mixed security posture. While it shows good practices in SQL query preparation (79%) and output escaping (67%), significant concerns arise from its attack surface and past vulnerability history. The presence of 3 unprotected AJAX handlers presents a direct entry point for attackers to potentially exploit vulnerabilities without proper authentication. The static analysis also reveals the use of the `unserialize` function, which can be a vector for remote code execution if not handled with extreme caution and robust input validation. The vulnerability history is particularly worrying, with a total of 6 known CVEs, all classified as medium severity. The types of past vulnerabilities, including Missing Authorization, Improper Authorization, Exposure of Sensitive Information, and Cross-site Scripting, suggest recurring issues with access control and input sanitization. The fact that the last vulnerability was dated 2026-02-20 (future date, likely a typo and indicates recent issues) and that there are currently no unpatched CVEs is a positive sign, but the pattern of past issues demands vigilance. The plugin's strengths lie in its SQL practices and output escaping, but these are overshadowed by the exposure of its attack surface and the historical trend of authorization and sanitization flaws.