PDF Builder for WooCommerce. Create invoices,packing slips and more Security & Risk Analysis

The 'woo-pdf-invoice-builder' plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation and a significant portion of output escaping, several concerning areas warrant attention. The static analysis reveals a substantial attack surface with 25 AJAX handlers, 11 of which lack authentication checks. This is further exacerbated by the taint analysis, which identified 6 high-severity flows with unsanitized paths. These findings suggest potential vulnerabilities related to input validation and authorization that could be exploited by attackers.

The plugin's vulnerability history is also a significant concern. With 10 known CVEs, including one high-severity and nine medium-severity issues, the historical pattern points to recurring security weaknesses such as CSRF, XSS, missing authorization, and SQL injection. Although no unpatched CVEs are currently listed, the prevalence of past vulnerabilities suggests a need for more robust security development practices and thorough testing. The presence of bundled libraries like dompdf, Select2, TinyMCE, and TCPDF, while common, also introduces potential risks if they are not kept updated to their latest secure versions.

In conclusion, while the plugin shows strengths in certain areas like SQL preparation, the numerous unprotected AJAX handlers, high-severity unsanitized taint flows, and a history of multiple CVEs indicate significant security risks. The plugin is not recommended for use without a thorough review of its current implementation and a plan to address the identified areas of concern.