wiseCampaign – Banners, Discounts & Sales Notifications for WooCommerce Security & Risk Analysis

The 'wisecampaign' v1.1.14 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding dangerous functions, file operations, and a high percentage of properly escaped outputs. The absence of known CVEs and taint flows with unsanitized paths is also a strong indicator of a generally secure codebase. However, there are significant concerns regarding its attack surface. A substantial portion of its entry points, specifically 13 out of 29, lack proper authentication or permission checks. This includes all 13 REST API routes and 0 of the AJAX handlers. While the total number of SQL queries is moderate, a concerning 67% are not using prepared statements, which could lead to SQL injection vulnerabilities if user input is not strictly validated and sanitized before being used in these queries.

The vulnerability history is clean, showing no recorded CVEs. This is a positive sign, suggesting the developers have a good track record or the plugin has not been a target of significant exploitation. However, the presence of numerous unprotected entry points and the use of raw SQL queries in a significant percentage of its database interactions present a tangible risk that could be exploited regardless of past history. The plugin's strengths lie in its output sanitization and lack of malicious function usage, but these are overshadowed by the considerable exposure of its REST API and the potential for SQL injection due to un-prepared statements.