Wiremo – Product Reviews for WooCommerce Security & Risk Analysis

The "woo-reviews-by-wiremo" plugin version 1.4.99 presents a moderate security risk. While it demonstrates some good security practices, such as a significant number of capability checks and nonces, several concerning areas are present. The static analysis revealed a notable number of unprotected entry points, specifically two REST API routes lacking permission callbacks. This is a significant concern as it could allow unauthorized access to sensitive functionalities.

Furthermore, the plugin exhibits poor database security by not utilizing prepared statements for any of its SQL queries, a critical omission that leaves it vulnerable to SQL injection attacks. The low percentage of properly escaped output (30%) also indicates a risk of cross-site scripting (XSS) vulnerabilities. The vulnerability history shows a pattern of "Missing Authorization" issues, with a currently unpatched medium severity CVE. This, combined with the static analysis findings, suggests a recurring problem with access control and overall code hardening.

In conclusion, while the plugin has a substantial attack surface, the presence of unprotected REST API routes and the complete absence of prepared statements for SQL queries are the most pressing issues. The historical trend of missing authorization vulnerabilities reinforces these concerns. Despite the presence of many capability checks, the identified weaknesses require immediate attention to mitigate the risk of exploitation.