Abandoned Cart Lite for WooCommerce Security & Risk Analysis

The "woocommerce-abandoned-cart" plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation (75%) and output escaping (93%), significant concerns arise from its attack surface and historical vulnerability trends.

The static analysis reveals 11 entry points, with 2 AJAX handlers lacking authentication checks. This is a critical oversight, potentially allowing unauthorized users to trigger plugin functionalities. Furthermore, 7 out of 15 analyzed taint flows have unsanitized paths, with all 7 classified as high severity. This indicates a substantial risk of data manipulation or execution of unintended code due to improperly handled user input.

The plugin's history of 12 known CVEs, including 2 critical and 2 high severity vulnerabilities, is concerning. The prevalence of Cross-Site Request Forgery (CSRF), Missing Authorization, and SQL Injection vulnerabilities suggests recurring weaknesses in input validation and access control. The most recent vulnerability in December 2023, even if currently patched, highlights an ongoing pattern of exploitable flaws. While the absence of currently unpatched CVEs is a positive sign, the historical data and identified code-level risks necessitate caution.