LTL Freight Quotes – XPO Edition Security & Risk Analysis

The ltl-freight-quotes-xpo-edition plugin version 4.3.15 presents a mixed security posture. While it demonstrates good practices like a reasonable number of nonce checks and capability checks relative to its entry points, significant concerns arise from its attack surface. A notable 17 out of 45 total entry points lack authentication checks, including 16 AJAX handlers and 1 REST API route without permission callbacks, creating a broad potential attack vector. Furthermore, the taint analysis indicates a high severity flow with unsanitized input, which, combined with a history of SQL injection vulnerabilities, suggests a persistent risk of data compromise. Although there are no currently unpatched CVEs, the past occurrence of a high-severity SQL injection vulnerability points to potential weaknesses in input validation and sanitization, which may be exacerbated by the large number of SQL queries in the code, nearly half of which do not use prepared statements. The plugin has strengths in its lack of dangerous functions and file operations, but the unprotected entry points and potential for injection vulnerabilities warrant careful consideration and monitoring.