WC Backorder Split Security & Risk Analysis

The "wc-backorder-split" plugin v2.1.0 demonstrates a strong security posture based on the provided static analysis. The code adheres to many WordPress security best practices, including the absence of dangerous functions, all SQL queries using prepared statements, and the presence of nonce and capability checks for its single AJAX handler. File operations and shortcodes are also absent, reducing the attack surface. The plugin also has no known historical vulnerabilities, suggesting a history of secure development and maintenance.

However, a potential area for improvement lies in output escaping. While 76% of outputs are properly escaped, this still leaves 24% potentially unescaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is ever included in these outputs. The single external HTTP request also warrants careful scrutiny to ensure it's being made securely and isn't susceptible to request hijacking or data leakage. Despite these minor points, the overall security of the plugin appears robust.