DPD Baltic Shipping Security & Risk Analysis

The plugin 'woo-shipping-dpd-baltic' v1.2.90 exhibits a concerning security posture, primarily due to its large attack surface consisting entirely of unprotected AJAX handlers. While the plugin demonstrates good practices in SQL query preparation (64%) and output escaping (93%), the lack of authorization checks on all 24 AJAX entry points presents a significant risk. The taint analysis reveals 3 high-severity flows with unsanitized paths, indicating potential for code injection or privilege escalation if these flows are triggered by user-supplied input.

The vulnerability history shows a pattern of medium-severity issues, specifically Cross-Site Scripting and Missing Authorization vulnerabilities, with the most recent one being in late 2024. Although there are no currently unpatched CVEs, this history suggests recurring weaknesses in input validation and access control. The combination of a wide open attack surface and identified high-severity taint flows, despite good internal coding practices for SQL and output, warrants significant caution.