LTL Freight Quotes – FreightQuote Edition Security & Risk Analysis

The "ltl-freight-quotes-freightquote-edition" plugin version 2.4.17 exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of properly escaped output and a significant number of nonce and capability checks, there are notable areas of concern. The presence of one unprotected REST API route is a direct entry point for potential unauthorized access or manipulation.

Static analysis revealed a concerning number of flows with unsanitized paths, with one identified as high severity. This, coupled with a significant percentage of SQL queries not using prepared statements, suggests a potential for SQL injection vulnerabilities. The plugin's history of known CVEs, including a high-severity one related to SQL Injection and missing authorization, further reinforces these concerns and indicates a recurring pattern of vulnerabilities in these areas. While there are no currently unpatched CVEs, the past issues and current code signals warrant careful attention.

In conclusion, while the plugin has strengths in output escaping and authorization checks, the identified unprotected API route and the potential for SQL injection due to a high number of raw SQL queries and unsanitized paths in taint analysis, coupled with historical vulnerability patterns, present significant risks. The plugin is not inherently insecure, but these specific weaknesses require remediation.