Whols – Wholesale Prices and B2B Store Solution for WooCommerce Security & Risk Analysis

The "whols" v2.4.9 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded vulnerability history, suggesting a generally secure development approach. The absence of dangerous functions, file operations, and bundled libraries is also a strength.

However, there are several areas of concern that warrant attention. The plugin exposes a significant attack surface with 29 total entry points, of which 4 are unprotected. Specifically, 3 out of 17 AJAX handlers lack authentication checks, and 1 out of 11 REST API routes is missing permission callbacks. While the taint analysis did not reveal critical or high severity vulnerabilities, it did identify one flow with an unsanitized path, which could potentially be exploited in conjunction with the unprotected entry points.

The plugin's strengths lie in its clean SQL handling and lack of historical vulnerabilities. The weaknesses are primarily related to authorization controls on its entry points and a single detected unsanitized path in its taint analysis. While not currently known to be exploitable, the unprotected entry points and unsanitized path represent potential vectors for future security issues if not addressed.