Aitasi Coming Soon Security & Risk Analysis

The 'aitasi-coming-soon' v2.0.2 plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query handling with 100% prepared statements and includes nonce and capability checks, significant concerns arise from its attack surface and code signals. The presence of an unprotected AJAX handler is a critical vulnerability, as it represents a direct entry point for malicious actors. Furthermore, the use of dangerous functions like 'unserialize' and 'create_function' raises red flags, especially in conjunction with the taint analysis indicating flows with unsanitized paths. This combination suggests a high risk of code injection or deserialization vulnerabilities if user-supplied data can influence these functions.

The vulnerability history, though showing only one medium-severity CVE, is concerning due to its recent discovery date (2025-09-05) and the fact that it remains unpatched. The common vulnerability type being 'Deserialization of Untrusted Data' directly aligns with the 'unserialize' function identified in the static analysis. This historical pattern strongly suggests a recurring weakness that needs immediate attention. The low percentage of properly escaped output (7%) further amplifies the risk, increasing the likelihood of cross-site scripting (XSS) attacks, especially when combined with the unprotected entry points.

In conclusion, despite some positive security implementations, the 'aitasi-coming-soon' v2.0.2 plugin has critical security weaknesses. The unprotected AJAX handler, use of dangerous functions, unsanitized taint flows, and an unpatched deserialization vulnerability pose a significant threat. The poorly escaped output exacerbates these risks. Immediate patching of the known CVE and a thorough review and remediation of the identified code signals and attack surface are strongly recommended.