ParcelWILL (Formerly ParcelPanel) – Shipment Tracking, Tracking & Order Tracking for WooCommerce Security & Risk Analysis

The Parcel Panel plugin, version 4.5.5, presents a mixed security posture. On the positive side, it demonstrates good practices in several areas, including a high percentage of SQL queries using prepared statements and properly escaped output. The use of nonces and capability checks is also present. However, significant concerns arise from the substantial attack surface exposed through AJAX handlers, with more than half of them lacking authentication checks. Furthermore, the taint analysis revealed four high-severity flows with unsanitized paths, indicating potential for attackers to exploit these vulnerabilities. The plugin's vulnerability history is also a notable weakness, with two known CVEs, including a past critical SQL injection and cross-site scripting vulnerability. While these are currently unpatched, the recurrence of these vulnerability types suggests a persistent risk in how user input is handled. Overall, while the plugin employs some strong security measures, the critical issues in its attack surface management and input sanitization, coupled with its vulnerability history, necessitate a cautious approach.