Brevo for WooCommerce Security & Risk Analysis

The "woocommerce-sendinblue-newsletter-subscription" plugin v4.0.52 presents a mixed security posture. While it demonstrates some good practices, such as using prepared statements for all SQL queries and having no known unpatched vulnerabilities, there are significant areas of concern.

The static analysis reveals a considerable attack surface with 6 AJAX handlers, all of which lack authorization checks. This is a critical oversight, as it means any user, regardless of their logged-in status or capabilities, could potentially interact with these handlers and trigger unintended actions or expose sensitive information. The taint analysis shows 4 flows with unsanitized paths, although none reached critical or high severity, these still warrant attention as they could be precursors to vulnerabilities if combined with missing sanitization or authorization. The limited output escaping (47%) also suggests potential for Cross-Site Scripting (XSS) vulnerabilities.

The plugin's vulnerability history, with 3 past CVEs including high-severity Cross-Site Scripting, Missing Authorization, and Path Traversal, is a strong indicator of past security weaknesses. The fact that the last vulnerability was in 2026 suggests ongoing issues, even if they are currently patched. The pattern of past vulnerabilities highlights a recurring need for robust input validation, authorization checks, and secure handling of file paths. While the current version has no unpatched CVEs, the historical trend and the static analysis findings, particularly the unprotected AJAX handlers and unsanitized paths, indicate a need for caution.