AnnunciFunebri Security & Risk Analysis

The "annuncifunebri-onoranza" v4.8.3 plugin demonstrates a generally good security posture with robust practices in place. The high percentage of properly escaped outputs and the exclusive use of prepared statements for SQL queries are positive indicators. The absence of critical or high severity taint flows, along with no identified flows with unsanitized paths, suggests that common injection vulnerabilities are well-mitigated.

However, a notable concern exists with the REST API. One route is exposed without a permission callback, creating an unprotected entry point. While the static analysis did not reveal critical taint flows stemming from this, the lack of authorization on a REST API endpoint is a significant risk, as it could potentially be exploited by unauthenticated users if sensitive operations are exposed. The plugin also utilizes a "dangerous function" (preg_replace(/e)), which, if not handled with extreme care, can lead to code execution vulnerabilities.

The vulnerability history shows a single medium severity CVE, which is now patched. This indicates that while past vulnerabilities have existed, they have been addressed. The common vulnerability type being "Missing Authorization" aligns with the observed unprotected REST API route. Overall, the plugin has strengths in its data handling but requires immediate attention to its REST API security.