Automated FedEx live/manual rates with shipping labels – HPOS supported Security & Risk Analysis

The "a2z-fedex-shipping" v5.1.8 plugin presents a concerning security posture primarily due to significant vulnerabilities in its attack surface and data handling. While the plugin shows some positive signs like a lack of known CVEs and a moderate use of prepared statements, these are overshadowed by critical security flaws identified in static analysis. The presence of an unprotected REST API endpoint is a major concern, as it represents a direct entry point for attackers. Furthermore, the taint analysis reveals two flows with unsanitized paths, indicating potential for severe security issues if these paths are exposed to user-controlled input. The complete absence of nonce and capability checks for any entry points amplifies these risks, leaving the plugin highly susceptible to unauthorized actions and privilege escalation.