Small Package Quotes – UPS Edition Security & Risk Analysis

The "small-package-quotes-ups-edition" v4.5.29 plugin exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output, several critical areas of concern exist. The static analysis reveals a significant attack surface with 31 entry points, of which 3 are unprotected, specifically 2 AJAX handlers and 1 REST API route lacking authentication or permission checks. Furthermore, the taint analysis identified 5 flows with unsanitized paths, including one of high severity, indicating a potential for vulnerabilities if these flows are exposed to untrusted input. The plugin's vulnerability history shows a single high-severity CVE for SQL Injection, which is currently patched. However, the past occurrence of such a vulnerability, coupled with the identified unsanitized paths, suggests a recurring risk profile.