Cocolis Officiel : Méthodes de livraison pour WooCommerce Security & Risk Analysis

The "cocolis" plugin version 1.1.5 exhibits a concerning security posture primarily due to a significantly exposed attack surface. All 8 REST API routes lack permission callbacks, making them directly accessible to any user, including unauthenticated ones. This represents a critical weakness as it allows for potential manipulation or unintended execution of plugin functionality by unauthorized actors. While the plugin does not utilize dangerous functions, performs SQL queries using prepared statements, and has no file operations or external HTTP requests, these strengths are overshadowed by the lack of authorization on its primary interaction points. The absence of nonces and capability checks further exacerbates the risk of cross-site request forgery (CSRF) and privilege escalation, especially in conjunction with the unprotected REST API endpoints. The taint analysis revealed two flows with unsanitized paths, which could potentially lead to path traversal vulnerabilities if not properly handled within the application context, although the severity was not classified as critical or high. The lack of any recorded vulnerability history, while positive, does not mitigate the inherent risks identified in the current static analysis. This plugin requires immediate attention to implement proper authentication and authorization mechanisms on its REST API endpoints to secure its functionality.