WC – APG NIF/CIF/NIE Field Security & Risk Analysis

The plugin 'wc-apg-nifcifnie-field' v4.9.0 presents a significant security risk due to its unprotected AJAX endpoints. With 6 out of 6 AJAX handlers lacking authentication checks, any authenticated user on a WordPress site could potentially trigger these functions, leading to unauthorized actions. While the code analysis shows good practices in output escaping and no critical taint flows or dangerous functions, the absence of capability checks on these AJAX endpoints is a major concern. The plugin's clean vulnerability history is a positive sign, suggesting it has not had publicly disclosed vulnerabilities in the past. However, this does not mitigate the immediate risks identified in the current static analysis. The lack of proper authorization for a substantial portion of its attack surface is a weakness that outweighs its strengths in other areas.