AccessWise – Power to restrict your website and it's content Security & Risk Analysis

The "accesswise" plugin v1.0.0 exhibits a mixed security posture. On the positive side, it demonstrates strong practices regarding SQL queries, exclusively using prepared statements, and shows a good output escaping rate (83%). The absence of known vulnerabilities and CVEs in its history is also a significant strength, suggesting a generally well-maintained codebase.

However, the plugin presents notable concerns due to its attack surface. Two AJAX handlers are exposed without any authentication checks, creating a direct entry point for potential attackers. Furthermore, the taint analysis revealed two flows with unsanitized paths, indicating a risk of insecure handling of user-supplied data, even though they are not categorized as critical or high severity in this analysis. The presence of a file operation and only one nonce check further highlights areas where security could be strengthened.

Overall, while the plugin benefits from a clean vulnerability history and secure SQL practices, the unprotected AJAX handlers and identified unsanitized path flows represent significant risks that require immediate attention. The plugin's current state suggests it has the potential for vulnerabilities if not addressed, particularly concerning how external inputs are handled and authenticated.