WC – APG Weight Shipping Security & Risk Analysis

The "woocommerce-apg-weight-and-postcodestatecountry-shipping" plugin v3.7.3 exhibits a mixed security posture. While the plugin avoids dangerous functions, file operations, and known CVEs, there are notable concerns regarding its attack surface and data sanitization. The presence of two AJAX handlers without authentication checks represents a significant entry point for potential unauthorized actions or information disclosure, especially when combined with a high-severity taint flow involving unsanitized paths. The fact that 57% of SQL queries are prepared is positive, but 43% are not, which could lead to SQL injection vulnerabilities if those queries handle user-supplied data without proper sanitization. The plugin also has a history of no recorded vulnerabilities, which suggests it might have good development practices or has not been thoroughly tested for certain classes of vulnerabilities. However, the static analysis reveals potential weaknesses that should be addressed.