Torod – The smart shipping and delivery portal for e-shops and retailers Security & Risk Analysis

The "torod" v2.1 plugin presents a mixed security posture. While it demonstrates some positive security practices, such as a high percentage of SQL queries using prepared statements and proper output escaping for a majority of outputs, significant concerns arise from its attack surface and historical vulnerability profile. The plugin exposes a considerable number of AJAX handlers without proper authentication checks, creating a broad entry point for potential unauthorized actions. This is further exacerbated by the presence of three high-severity taint flows with unsanitized paths, suggesting potential for vulnerabilities like path traversal or insecure file operations. The plugin's history of three known CVEs, including one currently unpatched high-severity vulnerability, and a recent discovery date, indicates a recurring pattern of security weaknesses. The common vulnerability types (CSRF, SQL Injection, Missing Authorization) align with the observed lack of authentication on AJAX handlers and the taint analysis findings. Overall, the plugin has potential strengths but is significantly weakened by its unprotected entry points and a history of exploitable vulnerabilities, demanding careful consideration and remediation.