Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices Security & Risk Analysis

The WooCommerce Wholesale Prices plugin version 2.2.7 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for its SQL queries and properly escaping a high percentage of its output. The presence of nonce and capability checks further indicates an awareness of common security vulnerabilities.

However, several concerns emerge from the static analysis. The plugin exposes a significant attack surface with 14 total entry points, of which 4 lack authentication checks. This is particularly worrying given the taint analysis revealed one high-severity flow with unsanitized paths, suggesting potential for exploitation if these unprotected entry points are involved.

The vulnerability history is a major red flag. With 6 known CVEs, including 3 high and 3 medium severity vulnerabilities, it indicates a recurring pattern of security weaknesses. The common types of vulnerabilities reported (Improper Privilege Management, Missing Authorization, XSS, CSRF) align with the findings of unprotected entry points and unsanitized paths. While there are currently no unpatched CVEs, the historical trend suggests a potential for future vulnerabilities to emerge if development practices do not improve. The plugin's strength in secure SQL and output handling is overshadowed by the significant risk posed by its unprotected entry points and historical vulnerability profile.