CityCourier – Local Courier Booking & Tracking System Security & Risk Analysis

The 'citycourier-local-courier-booking-tracking-system' plugin version 1.2.5 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries and includes a substantial number of nonce and capability checks. The absence of known CVEs and the lack of critical or high-severity taint flows are also strong indicators of a relatively well-maintained codebase. However, there are significant concerns regarding its attack surface, particularly with unprotected entry points.

Specifically, the presence of 2 AJAX handlers and 2 REST API routes lacking proper authentication or permission checks presents a direct vulnerability. While no dangerous functions or raw SQL queries were found, the high proportion of unsanitized paths in taint analysis (1 out of 3 flows) coupled with a substantial number of outputs that are not properly escaped (45% unescaped) indicates potential for cross-site scripting (XSS) or other injection vulnerabilities, especially if these unsanitized paths lead to unescaped output. The plugin's vulnerability history is clean, which is encouraging, but the static analysis findings suggest that proactive security measures against these identified weaknesses are crucial.