Voyapp Chile – Lugares y Cotizador de Despachos Security & Risk Analysis

The "voya-chile-lugares-y-cotizador-de-despachos" plugin, version 1.8.6, exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all its SQL queries and has no recorded history of vulnerabilities or known CVEs. This suggests a generally well-maintained codebase in terms of direct database manipulation and long-term security track record.

However, significant concerns arise from the attack surface analysis. The plugin exposes two REST API routes without any permission callbacks, meaning any authenticated user, regardless of their role, could potentially interact with these endpoints. Furthermore, the taint analysis indicates four flows with unsanitized paths. While these are not classified as critical or high severity, unsanitized paths can still lead to unexpected behavior or serve as vectors for further exploitation if other security measures are bypassed.

The absence of nonce checks on its entry points, combined with the unprotected REST API routes, presents a notable weakness. While the direct use of dangerous functions is zero, and file operations are not present, the presence of unsanitized flows and unprotected API endpoints, especially without nonce verification, creates potential avenues for attack that could be exploited by authenticated users. The plugin's vulnerability history is a strength, but it doesn't negate the risks identified in the static analysis.