WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping Security & Risk Analysis

The "wp-product-feed-manager" plugin, in version 2.20.1, presents a significant security concern primarily due to its extensive attack surface lacking proper authorization checks. With 38 AJAX handlers, 37 of which are unprotected, an attacker has a large number of potential entry points to exploit. While the plugin shows some good practices, such as a high percentage of SQL queries using prepared statements and a good proportion of output escaping, these are overshadowed by the critical flaw of exposed AJAX endpoints.

The vulnerability history reinforces these concerns. The plugin has a past of critical and high-severity vulnerabilities, including missing authorization, SQL injection, and XSS. While there are currently no unpatched vulnerabilities, the recurring nature of these common vulnerability types indicates systemic weaknesses in how user input and actions are handled and secured. The recent high-severity vulnerability further emphasizes the need for vigilance.

In conclusion, despite some positive code hygiene signals like prepared statements and output escaping, the plugin's security posture is weakened by its numerous unprotected AJAX endpoints and its history of severe vulnerabilities. The potential for attackers to leverage these unprotected entry points for malicious activities is high. Users should exercise caution and ensure this plugin is updated to the latest version, with a strong recommendation for developers to prioritize authorization checks on all AJAX handlers.