Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping Security & Risk Analysis

The 'track-orders-for-woocommerce' plugin exhibits a mixed security posture. On the positive side, it has a clean vulnerability history with no recorded CVEs, indicating a history of responsible development or timely patching. The code also demonstrates good practices in SQL query preparation and output escaping, with a very high percentage of queries using prepared statements and a strong majority of outputs being properly escaped. However, significant concerns arise from the static analysis. A substantial portion of the plugin's attack surface, specifically 14 out of 22 entry points, lacks authentication checks. This presents a considerable risk, as unauthenticated users could potentially interact with these components. Furthermore, the presence of the `exec` dangerous function, even if only 3 times, warrants caution, as it can lead to serious security issues if not handled with extreme care. The taint analysis found one flow with unsanitized paths, which, although not classified as critical or high severity, is still a potential avenue for exploitation that should be addressed.