Taxi Fare Calculator – TaxiFareFinder for WordPress Security & Risk Analysis

The plugin "taxi-fare-calculator-by-taxifarefindercom" v1.1.1 exhibits a mixed security posture. While it demonstrates good practices by avoiding dangerous functions, performing all SQL queries using prepared statements, and having no recorded vulnerability history, significant concerns arise from its handling of entry points and output escaping.

The static analysis reveals a small attack surface of two AJAX handlers, both lacking authentication checks. This is a critical security weakness, as it allows any unauthenticated user to trigger these handlers, potentially leading to unintended actions or information disclosure. Furthermore, the analysis indicates that 100% of output is not properly escaped, creating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis, though limited, shows one flow with unsanitized paths, which, when combined with unescaped output, could be exploited.

Despite the lack of historical vulnerabilities, the current findings present a substantial risk. The absence of authentication on AJAX endpoints and the pervasive lack of output escaping are serious coding flaws that should be addressed immediately to prevent potential exploitation.