Contact Me Security & Risk Analysis

The ajax-contact-me plugin v1.34 exhibits several concerning security practices despite a lack of recorded vulnerabilities. The static analysis reveals a notable attack surface, with two AJAX handlers identified, both of which lack authentication checks. This presents a significant risk as any unauthenticated user could potentially interact with these handlers, leading to unintended consequences. Furthermore, the plugin demonstrates poor output sanitization, with only 8% of outputs being properly escaped. This could open the door to cross-site scripting (XSS) vulnerabilities if user-supplied data is not correctly handled before being displayed. While the plugin does not use dangerous functions and all SQL queries are prepared, the lack of nonce checks on AJAX actions is a critical oversight. The absence of any historical vulnerabilities might suggest a low profile or a lack of targeted attacks, but it does not inherently indicate a secure codebase. The strengths lie in the absence of dangerous functions and the use of prepared statements for SQL. However, the two unprotected AJAX endpoints and the very low percentage of properly escaped output are substantial weaknesses that require immediate attention.