AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress Security & Risk Analysis

Acymailing v10.8.2 presents a mixed security posture. While it demonstrates good practices in using prepared statements for SQL queries and has a significant number of output escapements, several concerning indicators are present. The static analysis reveals a notable attack surface with an unprotected AJAX handler, a potential entry point for unauthorized actions. The presence of dangerous functions like `unserialize`, `preg_replace` with the `/e` modifier, and `popen` suggests areas where careful input validation and sanitization are critical to prevent code execution vulnerabilities. The taint analysis, though reporting no critical or high severity flows, shows that all analyzed flows had unsanitized paths, indicating a need for more robust input handling across the board.

The plugin's vulnerability history is a significant concern, with a total of four known CVEs, including one high and three medium severity vulnerabilities. The common vulnerability types observed (Unrestricted Upload, Cross-Site Scripting, Open Redirect) are often exploited through unprotected entry points or improper input sanitization, reinforcing the findings from the static analysis. The fact that these vulnerabilities have been patched (indicated by 0 currently unpatched CVEs) is a positive sign, but the recurring nature of certain vulnerability types suggests a persistent weakness in how external input is handled.

Overall, Acymailing v10.8.2 has areas of strength, particularly in its SQL query handling and extensive output escaping. However, the unprotected AJAX handler, the presence of dangerous functions, unsanitized taint flows, and a history of medium-to-high severity vulnerabilities necessitate careful consideration and diligent patching by users.