Distance Based Shipping Calculator Security & Risk Analysis

The "distance-based-shipping-calculator" plugin v2.1.0 exhibits a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries and a significant number of capability checks, there are notable areas of concern. The presence of unprotected AJAX handlers and REST API routes represents a significant attack surface that could be exploited by unauthenticated users. Furthermore, the taint analysis reveals flows with unsanitized paths, including two high-severity issues, which indicates potential vulnerabilities in how user input is handled and processed, possibly leading to cross-site scripting or other injection attacks. The plugin's history of four medium-severity CVEs, with the most recent being in February 2025, suggests a recurring pattern of vulnerabilities, particularly related to missing authorization, cross-site scripting, and SQL injection. Although there are currently no unpatched CVEs, this history warrants vigilance. Overall, the plugin has strengths in its core data handling but requires immediate attention to its input validation and access control mechanisms to mitigate identified risks.