WPC Estimated Delivery Date for WooCommerce Security & Risk Analysis

The "wpc-estimated-delivery-date" plugin version 2.6.3 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped output. The absence of known vulnerabilities (CVEs) and recorded past vulnerabilities suggests a generally stable codebase. However, there are notable areas of concern, primarily related to its attack surface. With 11 AJAX handlers, a significant portion (4) lack authentication checks, presenting potential entry points for unauthorized actions. Additionally, the presence of the `unserialize` function, a known security risk if input is not strictly controlled, is another point of caution. The taint analysis shows one flow with unsanitized paths, though it's not classified as critical or high, it warrants attention. The plugin's overall security is decent due to the lack of known exploits and good SQL/output handling, but the unprotected AJAX endpoints and `unserialize` usage introduce moderate risks that could be exploited if an attacker can trigger these functions with malicious input.