Product Filter for WooCommerce by WBW Security & Risk Analysis

The "woo-product-filter" v3.1.2 plugin exhibits a mixed security posture. While static analysis shows no identified entry points without authentication checks (AJAX, REST API, shortcodes) and a high percentage of properly escaped output, significant concerns remain. The presence of 16 dangerous function calls, notably "unserialize," presents a potential attack vector if not handled with extreme care, as it can lead to object injection vulnerabilities. The SQL query handling is also a point of concern, with 53% of queries not using prepared statements, increasing the risk of SQL injection, especially when combined with other potential weaknesses. The plugin's vulnerability history is substantial, with 6 known CVEs, all of which are currently patched. However, the historical prevalence of Missing Authorization and SQL Injection vulnerabilities indicates a pattern that requires ongoing vigilance from both the developer and users. The last recorded vulnerability being in the near future (2025-10-24) suggests a need for continuous security updates and auditing.

Despite the positive indicators like a lack of unprotected entry points and good output escaping, the identified dangerous functions and the significant portion of raw SQL queries are notable weaknesses. The vulnerability history, while currently patched, highlights recurring issues that have required significant attention. Users should be aware that while this version appears to have addressed past CVEs, the inherent code patterns like "unserialize" and less-than-ideal SQL practices warrant caution and prompt updates as new vulnerabilities may arise.