Fullscreen Menu Security & Risk Analysis

The "animated-fullscreen-menu" v3.0.1 plugin exhibits a concerning security posture due to a significant number of unprotected entry points. While the code analysis shows an absence of dangerous functions, file operations, and external HTTP requests, the presence of two AJAX handlers and one REST API route lacking authentication or permission checks creates direct vulnerabilities. The lack of nonce checks on AJAX handlers further exacerbates this risk, leaving the plugin susceptible to CSRF attacks. The single SQL query also lacks prepared statements, which, while not ideal, is a less severe concern given the limited number of queries and the absence of recorded vulnerabilities. The plugin's history of zero known CVEs is a positive indicator of past security diligence, but this does not negate the immediate risks identified in the current version's code. The use of a bundled library (Freemius v1.0) is also noted. Overall, while the plugin has a clean vulnerability history, the current static analysis reveals critical flaws in its input validation and authentication mechanisms that require immediate attention.