asAffili Security & Risk Analysis

This plugin exhibits a concerning security posture, primarily due to a significant attack surface that is largely unprotected. With 14 total entry points, a striking 12 are exposed without any authentication checks. This, combined with 11 high-severity taint flows involving unsanitized paths, strongly suggests a high likelihood of remote code execution or data compromise vulnerabilities. While the plugin does not appear to have a history of disclosed vulnerabilities (CVEs), this absence might be due to a lack of scrutiny rather than inherent security. The heavy reliance on prepared statements for SQL queries and the relatively good handling of output escaping in some areas are positive signs, but they are overshadowed by the critical lack of authorization checks on its numerous AJAX endpoints and the presence of untrusted data flowing through the application.