Order Notification for WooCommerce – Get Audio Alert on new Orders Security & Risk Analysis

The 'woc-order-alert' plugin v3.6.3 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and performing a significant number of nonce and capability checks. The absence of dangerous functions and file operations is also encouraging. However, concerns arise from the presence of an unprotected AJAX handler, representing a direct entry point without authentication, and three taint flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited. While there are no currently unpatched CVEs, the plugin's history of two medium severity vulnerabilities, including SQL injection, points to a recurring pattern of authorization and sanitization issues that warrant attention. The bundled Freemius library, if outdated, could also introduce risks. Overall, the plugin has strengths in secure SQL handling but requires immediate attention to its unprotected entry points and unsanitized data flows to improve its security posture.