Extra Fees for WooCommerce Security & Risk Analysis

The plugin "woo-conditional-product-fees-for-checkout" v4.3.3 exhibits a mixed security posture. On the positive side, it demonstrates strong practices regarding SQL queries, with all 9 queries using prepared statements. Furthermore, the vast majority (92%) of its output escaping is properly handled, and there are no recorded vulnerabilities in its history, suggesting a generally well-maintained codebase. However, a significant concern arises from its attack surface. Out of 12 total entry points, 11 are AJAX handlers that lack authentication checks. This presents a substantial risk, as any unauthenticated user could potentially interact with these handlers, leading to unintended actions or information disclosure if vulnerabilities exist within them. The absence of known CVEs is a positive indicator, but the large number of unprotected AJAX endpoints remains a primary security weakness that warrants attention.