Amadast Shipping افزونه حمل و نقل |ماشین حساب ارسال پست و تیپاکس و چاپار | پس کرایه |تنظیمات ارسال رایگان Security & Risk Analysis

The 'amadast-shipping-wp' plugin exhibits a mixed security posture. On the positive side, it has a clean vulnerability history with no known CVEs, and its code generally employs good practices like using prepared statements for SQL queries and performing nonce and capability checks on most entry points. The absence of dangerous functions and direct file operations without apparent sanitization is also encouraging.

However, there are notable concerns stemming from the static analysis. The plugin exposes 16 AJAX handlers, with a significant portion (4) lacking proper authentication checks. This represents a direct attack vector where unauthenticated users could potentially trigger unintended actions. Furthermore, the taint analysis revealed two flows with unsanitized paths, suggesting potential vulnerabilities related to path traversal or insecure file handling, even though they are not classified as critical or high severity. The presence of bundled libraries like Select2, if not kept up-to-date, could also introduce vulnerabilities.

In conclusion, while the plugin benefits from a strong track record and generally sound coding practices for SQL and output escaping, the unprotected AJAX endpoints and unsanitized path flows are critical areas for immediate attention. Addressing these weaknesses will significantly improve the plugin's overall security. The absence of past vulnerabilities is positive but does not negate the risks identified in the current static analysis.