Cities Shipping Zones for WooCommerce Security & Risk Analysis

The "cities-shipping-zones-for-woocommerce" plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and avoiding dangerous functions, file operations, and external HTTP requests. However, significant concerns arise from its attack surface and lack of robust input validation. Two out of three entry points, specifically AJAX handlers, lack authentication checks, making them prime targets for unauthorized actions.

The static analysis reveals a limited output escaping percentage (10%), indicating a potential for Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not properly handled before being displayed. The absence of nonce checks on AJAX handlers further exacerbates this risk, as it allows for Cross-Site Request Forgery (CSRF) attacks. Taint analysis showed no critical or high severity flows, which is positive, but this is in the context of zero total flows analyzed, suggesting limited depth in this analysis.

The plugin's vulnerability history includes one high-severity CVE related to Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion). While currently unpatched, the fact that the last vulnerability was in 2024 suggests a recent security concern that needs attention. The presence of this specific vulnerability type indicates a historical weakness in how the plugin handles file operations or user-supplied input that could influence file paths. While the current version has no unpatched CVEs, the past RFI vulnerability is a strong indicator of past insecure coding practices.