Wanderlust – Autocompletar dirección de Facturación – AFIP / ARCA Security & Risk Analysis

The plugin "wanderlust-autocompletado-del-checkout" v0.8 exhibits a concerning security posture primarily due to its unprotected entry points. With two AJAX handlers identified and neither possessing authentication or capability checks, this presents a significant attack surface. While the static analysis shows no dangerous functions, raw SQL queries, or file operations, and there are no recorded vulnerabilities in its history, the lack of basic security measures on its AJAX endpoints is a critical oversight. The presence of an external HTTP request also warrants attention, as its target and purpose are not detailed in the provided data, potentially introducing risks if not handled securely. Overall, while the plugin seems to avoid common pitfalls like unpatched CVEs or easily exploitable code patterns, the exposed AJAX handlers leave it vulnerable to unauthorized execution of its functions.