Midwest Logistics Security & Risk Analysis

The "midwest-logistics" v1.1.26 plugin exhibits a concerning security posture despite the absence of known vulnerabilities. The static analysis reveals a significant attack surface with three AJAX handlers, all of which lack authentication checks. This is a critical weakness, as it allows any unauthenticated user to trigger these handlers, potentially leading to unauthorized actions. Furthermore, the taint analysis identified two high-severity flows with unsanitized paths, indicating potential for path traversal or file inclusion vulnerabilities, even though no specific critical or high severity taint flows were explicitly found. While the plugin demonstrates good practices by using prepared statements for all SQL queries and performing nonce checks on its AJAX handlers, the lack of capability checks and the insufficient output escaping (only 32% properly escaped) introduce additional risks.