Open Close Store for WooCommerce – Business Hours Schedules Manager Security & Risk Analysis

The "woc-open-close" plugin version 4.9.9 presents a moderate to high security risk. While it demonstrates some good security practices, such as using prepared statements for all SQL queries and a high percentage of properly escaped output, several concerning factors remain. The presence of three unprotected AJAX handlers significantly increases the attack surface, allowing potential unauthenticated actions. Additionally, the use of the `unserialize()` function without proper input validation is a critical vulnerability that can lead to remote code execution if exploited. The plugin's vulnerability history is also a major concern, with four previously disclosed CVEs, two of which remain unpatched. The common types of vulnerabilities found (Remote File Inclusion, Missing Authorization, Cross-site Scripting) directly correlate with some of the identified weaknesses in the code analysis, particularly the unprotected AJAX handlers and potentially the `unserialize()` function if input is not carefully controlled. The late date of the last vulnerability (2025-10-08) suggests a recent discovery of issues, but the fact that two are unpatched is a significant red flag.