Product delivery date time for WooCommerce Security & Risk Analysis

The plugin 'product-delivery-date-time-for-woocommerce' v1.0.0 exhibits a mixed security posture. On the positive side, the code shows good practices regarding SQL queries, exclusively using prepared statements, and a very high percentage of properly escaped output, minimizing the risk of XSS vulnerabilities. There are no recorded vulnerabilities or CVEs in its history, which suggests a generally stable and well-maintained codebase.

However, significant security concerns are raised by the attack surface analysis. The plugin exposes two AJAX handlers, and critically, neither of them includes authentication checks. This lack of authorization on entry points is a major risk, potentially allowing unauthenticated users to trigger sensitive actions or manipulate data.

While taint analysis and vulnerability history are clean, the unprotected AJAX endpoints represent a substantial risk that overshadows the positive code signals. The absence of nonces and capability checks on these AJAX handlers further exacerbates this issue, making it easier for attackers to exploit. Therefore, immediate attention should be given to securing these entry points.