Furgonetka.pl: Przesyłki & Narzędzia e-commerce Security & Risk Analysis

The 'furgonetka' plugin v1.9.2 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped outputs. It also has no recorded vulnerability history, which is a strong indicator of good development and maintenance over time. However, a significant concern arises from the attack surface. All nine identified AJAX handlers lack authentication checks, meaning any unauthenticated user could potentially interact with these endpoints. While no critical or high severity taint flows were found, the presence of one flow with an unsanitized path warrants attention as it could be a vector for path traversal or other file-related vulnerabilities if exploited in conjunction with other factors. The limited number of capability checks (2) further exacerbates the risk associated with the unprotected AJAX handlers.