Super Speedy AJAX Prices security review
Security › Super Speedy AJAX Prices
Security score 100/100 · Version 1.15.7 · Reviewed 3 November 2026 · Source fingerprint a516d6a
Summary
We reviewed Super Speedy AJAX Prices 1.15.7 on 3 November 2026, and it scored 100/100 for security. The review was carried out by an AI agent working through our written security checklist. It read every file of the plugin’s own code. Each finding was reproduced on a private test site, and each fix was confirmed with a test that failed before the change and passes after it. The first review that day, of 1.15.6, scored 35/100.
What was found and fixed
- SECURITY-001, Critical, 25 points. With the Fast Ajax or Fast REST setting on, the plugin loads only WooCommerce, itself and your chosen pricing plugins for the price request, so that request runs faster. The check that decided whether a request was the price request looked at the web address. WordPress can, however, send a request with that address to a different endpoint. A visitor could therefore run another endpoint with your other plugins, security plugins included, switched off for that one request. Fix: the reduced set of plugins is now loaded only when WordPress will actually run the price request. The test checks the bypass on both Fast settings, and checks that the real price request is still reduced on all three of its address forms. Fixed in: 1.15.7.
- SECURITY-002, Medium, 25 points. The benchmark and the “what each customer sees” tools let an administrator test unsaved plugin choices with Ultra Ajax. Ultra loaded each entry in that list as a file path without checking it. Someone with the
manage_optionspermission could therefore make Ultra run any PHP file on the server. That matters on multisite networks, and on sites that stop administrators editing code. Fix: Ultra loads only active plugins. Any other entry stops the request with an error that names it, and the tools accept only active plugins. Fixed in: 1.15.7. - SECURITY-003, Medium, 15 points. Before showing a price, the plugin checked that the product was published. WooCommerce gives a variation its own status, separate from its parent product’s. Anyone could therefore read the prices of variations of draft, pending and private products. Fix: a variation’s price is shown only when its parent product is published. This applies to every way the price request can be made. Fixed in: 1.15.7.
The 90/100 published on 4 September 2026 reflected one finding in the shared licensing and update library that all our paid plugins carry:
- Licence key in update URLs, Medium, 10 points. Update downloads included the licence key in the download URL. Web servers, proxies and the update records WordPress keeps could all store that URL. Fix: the licence key is now sent in a request header that goes only to our update server. Fixed in: 1.15.5 (shared library 1.14.3). Version 1.15.6 also includes shared library 1.14.5, which stops the AI connection set-up from creating a user unless the person setting it up is allowed to add users.
What the review covered
| Area | Result | Evidence |
|---|---|---|
| Authentication, authorisation, ownership and request forgery | Checked | Benchmark, live and test mode, and the developer test tools need a nonce and manage_options or manage_woocommerce. The price request is public and read-only by design, and identifies the visitor from their login cookie. Fast Ajax reduces plugins only for the price request itself (SECURITY-001). Only published products are priced (SECURITY-003). |
| SQL injection | Checked | Product search escapes and binds its search term. User search goes through WordPress’s user query. The uninstall clean-up uses a fixed pattern. |
| Cross-site scripting | Checked | Admin output is escaped. Style settings are limited to a range or a valid colour before they reach the page. The benchmark screen sets text only. Prices on the shop come from WooCommerce’s own markup for the visitor asking. |
| Server-side request forgery, open redirects and header injection | Checked | Benchmark requests go only to the site’s own fixed endpoints. Preview addresses are matched to the site locally and never fetched. Redirects use WordPress’s safe redirect. |
| File uploads and path traversal | Checked | The plugin accepts no uploads. Ultra Ajax loads only active plugins (SECURITY-002). |
| Remote code execution and unsafe deserialisation | Checked | The code has no unserialize, no eval and no process calls. The one place that loaded a file by name now accepts only active plugins. |
| XML parsing | Not applicable | The plugin does not parse XML. |
| Secrets, privacy and data exposure | Checked | Benchmark and preview secrets are random, last 120 seconds and are compared in constant time. Detailed Ultra errors appear only to the benchmark or on sites with debugging on. The optional GTranslate diagnostics contain no IP addresses. |
| Business logic and caching | Checked | The price request changes nothing on the server, and each response contains only the requesting visitor’s own prices and cart. Responses are marked not to be cached. |
| Dependencies | Checked | The shared settings library is at 1.14.5 and has no known advisories. |
| JWT, GraphQL and server-side templates | Not applicable | The plugin uses none of these. |
Not scored
- The price request has no nonce, by design. Pages served from a full-page cache cannot carry a nonce for each visitor, and solving that is the reason this plugin exists. The request is read-only, and a different website cannot read its response. Each response contains only the prices and cart of the visitor who made it.
- The developer test tools. The frozen-cache tools are switched on only on sites marked as local or development, or when a developer turns them on in
wp-config.php. Their actions needmanage_woocommerceand a nonce.
