Accessibility Widget by OneTap – Easy One-Click Accessibility Toolbar Security & Risk Analysis

The 'accessibility-onetap' plugin v2.10.0 demonstrates a mixed security posture. On the positive side, it uses prepared statements for all SQL queries, and 99% of its outputs are properly escaped, significantly reducing the risk of SQL injection and cross-site scripting vulnerabilities. The absence of any known vulnerabilities or CVEs in its history is also a strong indicator of a well-maintained and secure codebase. However, the plugin presents a notable concern regarding its attack surface. A significant portion of its entry points, specifically 5 out of 6 total, lack proper authentication checks. This includes all 5 AJAX handlers, which are common targets for malicious actors. While no critical taint flows or dangerous functions were identified in the static analysis, the large number of unprotected entry points means that if any subtle vulnerability exists, it could be easily exploited. The plugin also implements nonce checks on all its AJAX handlers, which is a good practice, but this is undermined by the lack of capability checks on these same handlers.