Affilizz Security & Risk Analysis

The affilizz v1.15.4 plugin exhibits a mixed security posture. On the positive side, it has no known historical vulnerabilities and demonstrates good practices in SQL query sanitization (83% prepared statements) and output escaping (91%). The absence of dangerous functions and critical/high severity taint flows is also encouraging.

However, a significant concern arises from its attack surface. The plugin exposes 16 AJAX handlers, with a concerning 14 of them lacking proper authentication checks. This large number of unprotected entry points presents a substantial risk of unauthorized access and potential manipulation of plugin functionalities. While taint analysis didn't reveal critical issues, the presence of unsanitized paths in 7 out of 11 flows warrants further investigation to ensure these don't lead to exploitable vulnerabilities in conjunction with the unprotected AJAX actions.

In conclusion, while the plugin has a clean vulnerability history and good data handling practices, the substantial number of unprotected AJAX handlers is a critical weakness that significantly increases its risk profile. Addressing these unprotected endpoints should be a high priority to improve the overall security of the plugin.