Ninety in Ninety Security & Risk Analysis

The "90-in-90" plugin v0.1.1 exhibits a mixed security posture. While its SQL query implementation is strong, utilizing prepared statements exclusively, and it has no recorded vulnerability history, significant concerns arise from its attack surface and code signals. A substantial portion of its AJAX handlers (19 out of 21) lack authentication checks, presenting a broad entry point for potential unauthorized actions. Furthermore, the presence of dangerous functions like `set_time_limit` and `ini_set` warrants caution, as they can be exploited to manipulate server settings if not handled with extreme care. Although taint analysis did not reveal critical or high severity issues, the presence of unsanitized paths in flows suggests a potential for path traversal vulnerabilities that could be exacerbated by the unprotected AJAX endpoints. The limited proper output escaping (55%) also increases the risk of cross-site scripting (XSS) vulnerabilities.