ShipEngine Shipping Quotes Security & Risk Analysis

The shipengine-shipping-quotes plugin v1.1.1 exhibits a mixed security posture. While it demonstrates good practices in its use of prepared statements for SQL queries (84%) and output escaping (81%), and includes a significant number of nonce and capability checks (10 and 22 respectively), there are notable areas of concern stemming from its attack surface. Specifically, the plugin exposes 3 unprotected entry points across its AJAX handlers and REST API routes. This lack of authentication on critical functions increases the risk of unauthorized actions. Furthermore, the taint analysis reveals 3 flows with unsanitized paths, including one high-severity flow, indicating potential vulnerabilities that could be exploited. The plugin's vulnerability history, while currently showing no unpatched high-severity issues, does include a past high-severity SQL injection vulnerability. This pattern suggests that SQL injection remains a potential risk area for this plugin, and the current unsanitized flows could represent a resurgence of this issue. Overall, the plugin has a good foundation in secure coding principles but requires immediate attention to its unprotected entry points and unsanitized data flows to mitigate significant risks.