WC – APG City Security & Risk Analysis

The "wc-apg-city" plugin v2.0.4 exhibits a concerning security posture primarily due to its extensive use of unprotected AJAX handlers. While the code analysis reveals good practices in SQL query preparation and output escaping, the presence of four AJAX handlers without any authentication checks represents a significant attack surface. This means any unauthenticated user could potentially trigger these functions, leading to unintended actions or information disclosure depending on their implementation. The taint analysis shows no critical or high severity unsanitized flows, and the plugin has a clean vulnerability history with no known CVEs, which are positive indicators. However, the lack of capability checks and the reliance on unauthenticated AJAX endpoints overshadow these strengths.