CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress Security & Risk Analysis

The "advanced-nocaptcha-recaptcha" plugin v7.6.0 exhibits a generally good security posture, with a high percentage of SQL queries using prepared statements and a strong adherence to output escaping and nonce checks. The plugin also shows good practice by not bundling external libraries, which often become outdated and introduce vulnerabilities. However, a significant concern arises from the presence of an unprotected AJAX handler, creating a potential entry point for unauthorized actions. While the taint analysis reports no immediate critical or high severity issues, this uncovered AJAX handler warrants attention. The plugin's vulnerability history, particularly a past high-severity Cross-Site Request Forgery (CSRF) vulnerability, indicates a potential for similar issues if not diligently managed. Despite the current lack of unpatched CVEs and zero taint flows, the single unprotected AJAX handler is a clear risk that slightly degrades its otherwise strong security standing.