Epeken All Kurir for Woocommerce Security & Risk Analysis

The "epeken-all-kurir" v2.0.6 plugin exhibits a mixed security posture. While it demonstrates some good practices like a significant portion of SQL queries using prepared statements and a considerable number of output escapes, there are notable areas of concern. The static analysis reveals a substantial attack surface, with 11 total entry points, and importantly, one of these (a REST API route) lacks proper permission callbacks, presenting an immediate risk of unauthorized access or manipulation. Taint analysis indicates a significant number of flows with unsanitized paths (7 out of 9), although thankfully no critical or high-severity issues were identified in this analysis. The plugin's vulnerability history is a significant red flag. With three known CVEs, two of which remain unpatched, and a pattern of Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities, it suggests a recurring weakness in input validation and access control. The most recent vulnerability being in the future also points to potential issues with versioning or reporting accuracy. The presence of unpatched vulnerabilities, coupled with an unprotected entry point and numerous unsanitized taint flows, elevates the risk associated with this plugin.