[凹凸曼]自动推送Bing自动推送IndexNow Security & Risk Analysis

The "apoyl-bingpush" plugin v1.9.0 presents a moderate security risk due to a single unprotected AJAX handler, which represents the entire attack surface. While the plugin has no recorded vulnerability history, indicating a lack of publicly disclosed issues, this does not guarantee its current security. The static analysis reveals significant concerns regarding SQL query handling, with 100% of queries being un-prepared, posing a direct risk of SQL injection vulnerabilities. Additionally, one identified taint flow with unsanitized paths is flagged as high severity, indicating a potential for exploitation if user-supplied data is not properly handled. The plugin also exhibits a concerning lack of capability checks for its AJAX endpoint, meaning any authenticated user could potentially trigger its functionality without proper authorization.