Fast Courier – Shipping & Freight Security & Risk Analysis

The "fast-courier-shipping-freight" plugin v5.2.3 exhibits a concerning security posture due to a significantly large and unprotected attack surface. With 41 total entry points, including 39 AJAX handlers and 2 REST API routes, none of which have authentication or permission checks, this plugin is highly vulnerable to unauthorized access and manipulation. While the static analysis did not reveal critical or high severity taint flows, the lack of nonces and capability checks on these numerous entry points creates a wide open door for attackers to potentially exploit any vulnerabilities that might exist within the handler code itself, even if not immediately obvious from the static analysis. The plugin also shows a complete absence of recorded vulnerabilities, which can be a positive sign of diligent development, but in combination with the unprotected attack surface, it could also suggest that vulnerabilities have simply not been discovered or reported yet. The plugin's strengths lie in its use of prepared statements for all SQL queries and a generally good rate of output escaping (83%). However, these strengths are overshadowed by the critical weakness of exposed entry points.