WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell Security & Risk Analysis

The wpfunnels plugin version 3.9.5 presents a mixed security posture. While it demonstrates good practices like widespread use of prepared statements for SQL queries and a significant number of nonce and capability checks, several areas raise concerns. The static analysis reveals a large attack surface with 31 AJAX handlers lacking authentication, which is a significant risk. Furthermore, the presence of the 'unserialize' function without clear context on its usage is a potential vulnerability for deserialization attacks if user input is processed. The taint analysis, while reporting no critical or high severity flows, did identify 17 flows with unsanitized paths, indicating a potential for directory traversal or similar issues. The plugin's vulnerability history is particularly concerning, with 11 known CVEs, including a past critical vulnerability. The common types of past vulnerabilities, such as Path Traversal, Authorization Bypass, and Cross-site Scripting, align with some of the concerns identified in the static analysis. The plugin's last known vulnerability was in November 2025, which is in the future, suggesting this data might be hypothetical or an error. Overall, the plugin has strengths in its database query handling and some security checks, but the numerous unprotected AJAX endpoints, potential deserialization risks, and a history of critical and path-related vulnerabilities necessitate caution.