Sendle Shipping Plugin Security & Risk Analysis

The official-sendle-shipping-method plugin version 6.03 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and output escaping, significant concerns arise from its attack surface and historical vulnerability patterns.

The static analysis reveals that 2 out of 5 entry points, specifically AJAX handlers, lack authentication checks. This presents a direct pathway for unauthenticated users to potentially interact with sensitive plugin functionality. Although taint analysis did not identify critical or high severity flows, 11 flows with unsanitized paths warrant attention, suggesting potential for unexpected behavior or vulnerabilities if exploited in conjunction with other weaknesses.

The plugin's vulnerability history is a notable concern. It has had 3 medium-severity CVEs, including Missing Authorization, CSRF, and XSS. The fact that these vulnerabilities have occurred historically, even if currently patched, indicates a recurring pattern of security flaws. This suggests the development team may not have robust security testing or secure coding practices embedded in their development lifecycle. While the current version has no unpatched CVEs, the historical trend combined with the identified unauthenticated AJAX endpoints creates a moderate risk profile.