LTL Freight Quotes – ABF Freight Edition Security & Risk Analysis

This plugin, "ltl-freight-quotes-abf-freight-edition" v3.3.21, presents a mixed security posture. While it has a history of known vulnerabilities, specifically a high-severity SQL Injection, the current version shows no unpatched CVEs and a relatively good number of capability checks and nonces. However, the static analysis reveals concerning areas. A significant attack surface exists with 32 entry points, two of which are entirely unprotected (one AJAX handler and one REST API route). Furthermore, the taint analysis indicates a critical flow with unsanitized paths, suggesting potential for exploitation. The SQL query usage is also a concern, with 52% of queries not using prepared statements, increasing the risk of SQL injection even if not immediately apparent in the taint analysis. The output escaping is also not consistently applied, with only 57% properly escaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history, particularly the prevalence of SQL Injection, combined with the findings in static and taint analysis, indicates that careful attention to input validation and output sanitization is paramount for this plugin.