Affiliates Manager Security & Risk Analysis

The "affiliates-manager" v2.9.49 plugin presents a mixed security posture. While it exhibits good practices in areas like prepared SQL statements (91%) and a high percentage of properly escaped output (82%), significant concerns arise from its attack surface and historical vulnerability patterns. A substantial portion of its entry points, particularly AJAX handlers (8 out of 8 analyzed), lack authentication checks, creating a broad attack vector. The taint analysis reveals a concerning 8 high-severity flows with unsanitized paths, indicating potential for exploitable vulnerabilities even if no critical ones were found in this specific analysis run. The plugin's history of 12 known CVEs, including critical and high-severity issues, with the most recent in early 2024, suggests a recurring pattern of security weaknesses. The common vulnerability types also point to common attack vectors that have been exploited in the past. While the absence of currently unpatched vulnerabilities is positive, the overall trend and the identified static analysis issues necessitate a cautious approach.