WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices Security & Risk Analysis

The "wholesalex" v2.3.3 plugin exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices like the use of prepared statements for all SQL queries and a high percentage of properly escaped output, several significant concerns remain. The large attack surface, with 26 out of 51 entry points lacking authentication or permission checks, presents a substantial risk. This includes a concerning number of unprotected AJAX handlers and REST API routes, which could allow unauthenticated users to trigger plugin functionality.

The vulnerability history is also a major red flag. With a total of 4 known CVEs, including one previously classified as critical, and a recent vulnerability discovered in March 2024, it suggests a pattern of security flaws. The common vulnerability types such as Improper Privilege Management, Missing Authorization, and Exposure of Sensitive Information point to recurring issues in how the plugin handles user access and data security. While there are currently no unpatched CVEs, the history of critical vulnerabilities warrants caution.

In conclusion, despite positive aspects like robust SQL handling and output escaping, the plugin's significant number of unprotected entry points and its history of critical vulnerabilities make it a moderate to high-risk plugin. The lack of authentication on a substantial portion of its attack surface, coupled with past critical flaws, necessitates careful monitoring and prompt updates. The plugin's developers need to address the authorization gaps in its entry points to improve its overall security posture.