CartBounty – Save and recover abandoned carts for WooCommerce Security & Risk Analysis

The "woo-save-abandoned-carts" plugin version 8.10 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for the vast majority of its SQL queries and has no known unpatched vulnerabilities. It also lacks file operations and external HTTP requests, which reduces certain attack vectors. However, significant concerns arise from the attack surface. All 11 AJAX handlers are exposed without any authentication checks, creating a large potential entry point for attackers. Furthermore, the taint analysis reveals 6 high-severity flows with unsanitized paths, indicating potential for malicious data to be processed in unintended ways, even though no critical severity issues were found. The plugin's vulnerability history shows a single medium-severity CSRF vulnerability, which, while patched, suggests a history of security weaknesses that require ongoing vigilance. While the plugin has strengths in database query security and a lack of critical unpatched issues, the unprotected AJAX endpoints and high-severity taint flows represent immediate and serious risks that need to be addressed.