LTL Freight Quotes – TQL Edition Security & Risk Analysis

The "ltl-freight-quotes-tql-edition" v1.2.11 plugin exhibits a mixed security posture. While it demonstrates some good practices, such as a moderate use of prepared statements for SQL queries and a good number of capability checks, there are significant areas of concern. The presence of unprotected AJAX handlers and REST API routes creates direct entry points for potential attackers. The taint analysis revealing unsanitized paths, particularly one with high severity, is a critical finding that could lead to various exploitation vectors if data is not properly handled. Furthermore, the plugin's vulnerability history, although currently showing no unpatched vulnerabilities, includes a past medium-severity "Deserialization of Untrusted Data" vulnerability. This suggests a recurring pattern of potential weaknesses in data handling, which, when combined with the identified unsanitized taint flows, warrants careful attention. Overall, while the plugin has strengths, the unprotected entry points and critical taint flow present notable risks that require remediation.