Scheidungskostenrechner Security & Risk Analysis

The "aw-skr" plugin v1.0.7 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded vulnerabilities. The presence of nonce checks and capability checks on some entry points is also a positive sign. However, the analysis reveals significant concerns regarding its attack surface and data sanitization.

Specifically, the plugin exposes two AJAX handlers without authentication checks, creating a substantial risk. Furthermore, the taint analysis indicates one flow with an unsanitized path of high severity, suggesting that user-supplied input could be manipulated to execute unintended actions or access sensitive data. The plugin also has a moderate rate of improperly escaped output, which could lead to cross-site scripting (XSS) vulnerabilities if user input is reflected without proper sanitization.

While the lack of known CVEs and a clean vulnerability history are encouraging, they do not negate the immediate risks identified in the static analysis. The presence of unprotected entry points and a critical taint flow points to a need for immediate attention to secure these aspects of the plugin. Overall, the plugin has some good security foundations but requires further hardening to address its identified weaknesses.