Plugin inspection:

WooCommerce – excelling eCommerce

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 2.1.12 of this plugin, but the most recent version is 9.1.4. These findings may no longer be correct.

Findings

  • At over 43,000 lines of PHP this is a very large plugin, which makes it difficult to thoroughly assess
  • Contains an XSS vulnerability: https://advisories.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do/
  • Uses eval() and create_function() (i18n/makepot/extract/extract.php line 203, i18n/makepot/not-gettexted.php lines 73, 78, 111, i18n/makepot/pomo/po.php lines 168, i18n/makepot/pomo/translations.php line 171)
  • In one instance where eval is used (i18n/makepot/extract/extract.php line 203) a comment above says “we can use eval safely, because we are sure $text is just a string literal” This is false, since $text is clearly taken from the output of token_get_all()
  • Values are put into SQL unescaped (includes/abstracts/abstract-wc-product.php line 1191, includes/wc-order-functions.php line 26, etc)

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

  • Contains XSS vulnerability: https://advisories.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do/

Failure criteria

  • Execution of unprepared SQL statements
  • Unsafe generation of PHP code
  • Lack of proper output escaping
  • Very large codebase

Read more about our failure criteria.