WPCargo Track & Trace Security & Risk Analysis

The WPCargo plugin version 8.0.2 exhibits a concerning security posture, despite some positive aspects. While it demonstrates a decent rate of prepared statement usage for SQL queries and proper output escaping, these strengths are overshadowed by significant weaknesses. The presence of 5 unprotected AJAX handlers presents a substantial attack surface, as these entry points can be exploited without proper authentication. Furthermore, the taint analysis reveals 3 high-severity flows with unsanitized paths, indicating potential for serious vulnerabilities like cross-site scripting or injection attacks. The plugin's history of 6 CVEs, with 3 currently unpatched (including one critical and one high), highlights a recurring pattern of security flaws. The types of past vulnerabilities, including authorization bypass, SQL injection, XSS, and code injection, are particularly worrying and suggest a systemic issue in how user input is handled and access is controlled. The plugin's last reported vulnerability was recent, suggesting ongoing security challenges.