AJAX Manufactory Security & Risk Analysis

The ajax-manufactory plugin version 1.7.11 presents significant security concerns due to a lack of proper authorization checks on its entry points. The static analysis reveals two AJAX handlers, both of which operate without any authentication or capability checks. This creates a large, unprotected attack surface, allowing any unauthenticated user to potentially trigger these functions. While the plugin exhibits good practices in other areas, such as using prepared statements for SQL queries and not making external HTTP requests, the fundamental oversight in securing its AJAX endpoints is a critical vulnerability. The absence of any known vulnerabilities in its history is a positive sign, suggesting past development may have been more secure, but it does not mitigate the current risks identified in the code. Therefore, while the plugin avoids certain common pitfalls, the unprotected AJAX handlers make it a high-risk target.