Plugin Ongkos Kirim JNE Tiki Sicepat Wahana J&T POS for Woocommerce Security & Risk Analysis

The ongkoskirim-id plugin v1.0.6 exhibits a concerning security posture, primarily due to a significant lack of authorization checks on its entry points. All 6 identified AJAX handlers are exposed without any authentication or capability checks, creating a wide attack surface for unauthenticated users. While the plugin does not appear to use dangerous functions or raw SQL queries, the high percentage of improperly escaped output (87%) is a notable weakness that could lead to cross-site scripting (XSS) vulnerabilities. The taint analysis, while showing no critical or high-severity flows, does indicate 5 flows with unsanitized paths, which, combined with the lack of output escaping, warrants attention. Furthermore, the plugin has a history of known vulnerabilities, including one currently unpatched medium-severity CVE. This suggests a pattern of security oversights, with missing authorization being a recurring issue. Despite the absence of raw SQL and dangerous functions, the numerous unprotected AJAX endpoints, poor output escaping, and past vulnerability history make this plugin a moderate to high risk.