Accessibility by AllAccessible Security & Risk Analysis

The 'allaccessible' plugin v2.0.4 exhibits a mixed security posture. On the positive side, it demonstrates good practices by implementing nonce checks for all its AJAX handlers and capability checks for most operations. The absence of shortcodes, cron events, and REST API routes, coupled with 0 unprotected entry points, significantly limits the potential attack surface. The plugin also avoids dangerous functions, file operations, and bundled libraries, which are common sources of vulnerabilities. However, a significant concern arises from the static analysis revealing that 100% of its single SQL query does not use prepared statements. While taint analysis did not uncover critical or high-severity issues, the presence of 2 flows with unsanitized paths warrants attention. The plugin's vulnerability history is also a concern, with 2 previously disclosed high-severity vulnerabilities of the types Incorrect Privilege Assignment and Missing Authorization. The fact that these are listed as 'currently unpatched' (despite the 'unpatched' count being 0) and the recentness of the last vulnerability (2025-01-03) suggest a pattern of past security weaknesses that requires ongoing vigilance, even if current version appears to have addressed them. Overall, while the current version seems to have improved in some areas like auth checks, the historical trend and the unaddressed SQL query risk indicate a need for caution.