Apptivo Business Site Security & Risk Analysis

The "apptivo-business-site" plugin version 5.4 exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices regarding SQL queries and output escaping, with 100% of both using prepared statements and proper escaping, respectively. The plugin also incorporates a healthy number of nonce and capability checks. However, a significant concern arises from the presence of two AJAX handlers that lack authentication checks, creating a direct attack vector. Additionally, the taint analysis reveals that 11 out of 22 analyzed flows involve unsanitized paths, indicating a potential for vulnerabilities if these paths are exposed to user input without proper sanitization, even though no critical or high severity issues were identified in this analysis. The plugin's vulnerability history is also a major red flag, with three medium-severity CVEs, including one that remains unpatched. The types of historical vulnerabilities (Missing Authorization, CSRF, XSS) align with the identified risks in the code analysis, suggesting a pattern of insecure handling of user input and access control.