Small Package Quotes – USPS Edition Security & Risk Analysis

The "small-package-quotes-usps-edition" v1.3.12 plugin exhibits a mixed security posture. While it generally adheres to good practices with a high percentage of prepared SQL statements and properly escaped output, there are notable concerns. The attack surface is relatively large with 19 entry points, and critically, 3 of these (18% of AJAX handlers and 1 REST API route) lack authentication or permission checks, creating potential access points for unauthorized actions. Taint analysis revealed a high-severity flow with unsanitized data, indicating a potential for exploitation. The plugin's vulnerability history, with 2 known CVEs including a high and medium severity flaw, suggests a past pattern of security weaknesses, particularly related to deserialization and SQL injection. Although there are currently no unpatched vulnerabilities, the historical context and the findings from the static analysis warrant caution. The plugin demonstrates strengths in its use of prepared statements and output escaping, but the unprotected entry points and past vulnerability trends highlight areas needing immediate attention and ongoing monitoring.