WooMS Security & Risk Analysis

The "wooms" v9.12 plugin presents a mixed security posture. While it demonstrates good practices by avoiding dangerous functions, using prepared statements for all SQL queries, and having no critical or high severity taint flows, significant concerns arise from its unprotected entry points. With 3 out of 4 identified entry points (AJAX handlers and REST API routes) lacking proper authentication or permission checks, this plugin exposes itself to potential unauthorized access and manipulation. The plugin also has a history of medium severity vulnerabilities, specifically related to missing authorization and cross-site scripting, with three currently unpatched CVEs. This suggests recurring security weaknesses in how user input and actions are handled.

Despite the absence of critical code-level flaws in the static analysis, the combination of a large unprotected attack surface and a history of unpatched vulnerabilities indicates a moderate to high risk. The unpatched CVEs, in particular, are a pressing concern, as they represent known and exploitable weaknesses. While the plugin benefits from proper SQL handling and output escaping in a majority of cases, these strengths are overshadowed by the critical need for robust authorization checks on its exposed entry points and the urgency of addressing the existing, unpatched vulnerabilities.