BOX NOW Delivery Security & Risk Analysis

The "box-now-delivery" plugin v3.0.2 exhibits a concerning security posture primarily due to a significant number of unprotected AJAX handlers. While the plugin demonstrates good practices by utilizing prepared statements for all SQL queries and largely escaping output, the lack of authorization checks on 9 out of 12 entry points creates a substantial attack surface. The taint analysis did not reveal any critical or high-severity vulnerabilities, which is a positive sign. However, the presence of unsanitized paths in 5 out of 7 analyzed flows warrants further investigation, as these could potentially lead to issues if exploited in conjunction with other vulnerabilities.

The plugin's vulnerability history is a major red flag. It has a known, unpatched medium-severity CVE from early 2026, and the pattern of past vulnerabilities indicates a recurring issue with missing authorization. This suggests a consistent oversight in securing critical functionalities within the plugin. Despite the positive aspects like secure SQL handling and good output escaping, the combination of a large number of unprotected AJAX endpoints and a history of authorization-related vulnerabilities points to a medium-to-high overall risk for websites using this plugin.