Fortnox for WooCommerce Security & Risk Analysis

The 'woocommerce-fortnox-integration' v4.6.1 plugin presents a concerning security posture, primarily due to its substantial attack surface lacking proper authorization. With 11 unprotected AJAX handlers, there's a significant risk of unauthorized actions being performed. While the code analysis shows no directly exploitable critical or high severity taint flows, the presence of unsanitized paths in one flow, coupled with only 36% proper output escaping, indicates potential for cross-site scripting (XSS) vulnerabilities if malicious input is not handled rigorously. The plugin also exhibits a history of medium severity vulnerabilities, including XSS and missing authorization, which is particularly worrying given the current lack of authorization checks on its entry points. Although the use of prepared statements for SQL queries is a positive sign, and there are no unpatched CVEs at this time, the plugin's fundamental lack of security on its primary interaction points (AJAX handlers) and its past vulnerability patterns outweigh these strengths, suggesting a need for immediate attention and remediation.