MultiParcels Shipping For WooCommerce Security & Risk Analysis

The "multiparcels-shipping-for-woocommerce" plugin v1.30.18 presents a mixed security posture. While the static analysis shows good practices like a high percentage of prepared SQL statements and properly escaped output, and importantly, no critical or high severity taint flows, there are significant concerns. The plugin exposes 22 AJAX handlers, with 2 of them lacking any authentication checks, creating a direct entry point for unauthorized actions. The vulnerability history is a major red flag, with a total of 8 known CVEs, including 2 high severity vulnerabilities related to Missing Authorization and Cross-Site Request Forgery (CSRF). The presence of medium severity vulnerabilities in the past, such as SQL Injection and Cross-Site Scripting, also indicates a pattern of past security weaknesses. The last reported vulnerability in late 2025 suggests that while current unpatched vulnerabilities might be zero, the plugin has a history of being a target.