ACTUS Deep Schema Security & Risk Analysis

The 'actus-deep-schema' plugin v1.3.2 demonstrates some good security practices, such as using prepared statements for all SQL queries and a high percentage of properly escaped output. The absence of any recorded vulnerabilities or CVEs in its history is a positive indicator. However, a significant security concern arises from the large attack surface presented by its AJAX handlers. A substantial number of these handlers (18 out of 22) lack authentication checks, creating a significant potential entry point for attackers. While taint analysis didn't reveal critical or high-severity unsanitized flows, the presence of six flows with unsanitized paths warrants attention, especially when combined with unprotected AJAX endpoints. The plugin also has several file operations and external HTTP requests, which, while not inherently insecure, increase the potential for exploitation if not properly secured against vulnerabilities that might arise from their usage. Overall, the plugin has strengths in its data handling but is weakened by a large number of unauthenticated entry points.