Partial Shipment for Woocommerce Security & Risk Analysis

The "wc-partial-shipment" plugin v3.4 exhibits a mixed security posture. On the positive side, all SQL queries are properly prepared, and there are no identified critical or high-severity taint flows, indicating good practices in database interaction and data handling.

However, significant concerns arise from the attack surface. The plugin exposes three AJAX handlers, all of which lack authentication checks. This presents a substantial risk as any unauthenticated user could potentially interact with these endpoints, leading to unintended actions or information disclosure if the underlying functions are not robustly secured. Furthermore, the absence of nonce checks on AJAX handlers is a critical oversight, leaving the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks.

The vulnerability history shows one medium-severity SQL injection vulnerability, which, while patched, highlights a past weakness in input sanitization or query construction. The fact that this was a medium severity vulnerability and occurred in the past suggests that developers have addressed some issues, but the current lack of AJAX authentication and nonce checks are pressing immediate concerns that need to be rectified.