PPOM – Product Addons & Custom Fields for WooCommerce Security & Risk Analysis

The "woocommerce-product-addon" plugin exhibits a concerning security posture primarily due to a substantial attack surface with a high percentage of unprotected entry points. While the plugin demonstrates good practices in SQL query preparation and output escaping, the lack of authorization checks on many AJAX handlers and REST API routes creates significant vulnerabilities. Taint analysis further highlights critical risks with three high-severity flows indicating potential for injection attacks, even with the absence of critical severity taint. The plugin's history of 11 known CVEs, including critical SQL injection, XSS, and authorization bypass vulnerabilities, strongly suggests a recurring pattern of exploitable weaknesses, with a recent vulnerability in late 2025 reinforcing this concern. Although the current version has no unpatched CVEs, the historical data and the static analysis findings present a picture of a plugin that, while improving in some areas, still carries significant inherent risks.