OrderBadger Security & Risk Analysis

The orderbadger plugin, version 1.1.0, exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices by utilizing prepared statements for all SQL queries and properly escaping the vast majority of its output. There are no recorded vulnerabilities or CVEs, indicating a history of good security. However, significant concerns arise from the static analysis. The plugin exposes one unprotected REST API route, which represents a direct entry point for potential attackers without any authentication or authorization checks. Furthermore, the taint analysis reveals a high number of flows with unsanitized paths, with 7 categorized as high severity. This suggests that data processed by the plugin could be manipulated by attackers to execute malicious actions or expose sensitive information, despite the general use of prepared statements for direct SQL interaction.