Estimated Delivery Date Per Product For Woocommerce Security & Risk Analysis

The plugin "estimated-delivery-date-per-product-for-woocommerce" v1.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and having no recorded vulnerabilities or CVEs. This suggests a generally well-maintained codebase.

However, there are significant security concerns stemming from the attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks. This is a critical weakness that could allow unauthenticated users to trigger potentially harmful actions. Furthermore, the output escaping is only moderately effective, with 57% of outputs properly escaped, leaving room for cross-site scripting (XSS) vulnerabilities if user-supplied data is involved in the unescaped outputs.

The lack of any recorded vulnerabilities in its history is a strength, but it doesn't negate the immediate risks identified in the static analysis. The primary concern lies in the unprotected AJAX endpoints. While the plugin avoids dangerous functions and external requests, the unprotected entry points and moderate output escaping require attention to ensure robust security.