LlegoYa Envíos Security & Risk Analysis

The plugin 'llegoya-envios' v2.4.1 exhibits a mixed security posture. On the positive side, the code demonstrates good practices regarding SQL queries, consistently using prepared statements, and all identified output is properly escaped, indicating a low risk of cross-site scripting (XSS) vulnerabilities stemming from output handling. Furthermore, the absence of known CVEs and a clean vulnerability history suggests the developers have a generally good track record for security. However, significant concerns arise from the attack surface analysis. The plugin exposes two AJAX handlers, both of which lack any authentication or capability checks. This presents a substantial risk as any unauthenticated user could potentially interact with these entry points, leading to unintended functionality or information disclosure if not properly secured internally. While taint analysis found no explicit flows with unsanitized paths and no dangerous functions were identified, the lack of authentication on AJAX handlers is a critical oversight that could allow attackers to exploit these points regardless of internal code sanitization. The absence of nonce checks on these AJAX handlers exacerbates this risk, making it easier for attackers to trigger these functions programmatically.