AeroLeads Contact Us Details Security & Risk Analysis

The aeroleads-contact-us-details v2.0.0 plugin exhibits a concerning security posture due to several identified weaknesses in its static analysis. A significant attack surface is exposed through two AJAX handlers, both of which lack proper authentication checks, making them prime targets for unauthorized access and execution of potentially harmful operations. Furthermore, the complete absence of nonce checks on these entry points exacerbates this risk, allowing for easier Cross-Site Request Forgery (CSRF) attacks.

The code analysis reveals a critical reliance on dangerous functions, specifically `create_function`, which is known to be a significant security risk. The plugin also performs a substantial number of SQL queries without any form of prepared statements, indicating a high likelihood of SQL injection vulnerabilities. Compounding these issues is the extremely poor output escaping, with only 2% of outputs being properly handled, leaving the plugin susceptible to Cross-Site Scripting (XSS) attacks. While the plugin has no recorded vulnerability history, this can be misleading; the absence of past CVEs does not guarantee current security. The combination of these code-level flaws presents a substantial risk.

In conclusion, despite a clean vulnerability history, the static analysis of aeroleads-contact-us-details v2.0.0 reveals critical security flaws. The unprotected AJAX handlers, lack of nonce and capability checks, use of `create_function`, unescaped output, and raw SQL queries create a highly vulnerable plugin. Users should exercise extreme caution and consider disabling or replacing this plugin until these significant security deficiencies are addressed.