Addiction Recovery Connector Security & Risk Analysis

The addiction-recovery-connector plugin, version 1.1.5, exhibits a mixed security posture. While the absence of known CVEs and dangerous functions is a positive sign, several critical security concerns are present in the static analysis results. A significant portion of the attack surface, specifically 2 AJAX handlers and 1 REST API route, are not protected by authentication checks or permission callbacks. This lack of authorization exposes these entry points to potential unauthorized access and manipulation. Furthermore, the taint analysis reveals flows with unsanitized paths, indicating potential risks related to handling user-supplied data, although no critical or high-severity issues were identified in this area. The code also shows a moderate level of output escaping and a substantial number of SQL queries, with a concerning percentage not utilizing prepared statements, which can lead to SQL injection vulnerabilities. The presence of an outdated bundled jQuery library is another weakness. Overall, the plugin has strengths in its lack of historical vulnerabilities and avoidance of clearly dangerous functions, but the unprotected entry points and potential for SQL injection and data sanitization issues present notable risks that require immediate attention.