Фулфилмент от Почты России для маркетплейса Dokan Security & Risk Analysis

The "russian-post-for-dokan-marketplace" v1.0.4 plugin presents a concerning security posture due to its significant attack surface lacking proper authentication. All five identified AJAX handlers do not have authentication checks, meaning any user, including unauthenticated ones, could potentially trigger these actions. While the plugin demonstrates good practices by using prepared statements for all SQL queries and has a clean vulnerability history with no known CVEs, this is heavily overshadowed by the lack of security on its entry points. The taint analysis found four flows with unsanitized paths, although they were not flagged as critical or high severity. This suggests a potential for issues if data is not handled carefully within these flows, even if they don't directly lead to immediate exploits in this specific analysis. The overall impression is a plugin that has some good technical foundations but suffers from critical oversight in securing its interactive components, making it a target for attackers seeking to leverage unauthenticated actions.