Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch Security & Risk Analysis

The 'axeptio-sdk-integration' v2.6.1 plugin exhibits a generally strong security posture, particularly evident in its handling of entry points. With zero unprotected AJAX handlers, REST API routes, shortcodes, or cron events, the attack surface is well-secured. The code also demonstrates good practices with a high percentage of properly escaped output and the absence of dangerous functions or file operations. External HTTP requests are present but are not inherently a security risk in isolation.

However, there are a couple of areas for concern. The plugin uses 50% of its SQL queries without prepared statements, which could leave it vulnerable to SQL injection if the unsanitized queries handle user-supplied input. The absence of nonce checks is a significant omission, especially considering the presence of REST API endpoints. While static analysis found no direct taint flows, the lack of nonce checks on potentially user-facing API routes is a considerable risk. The plugin's vulnerability history, specifically a past critical CVE related to 'PHP Remote File Inclusion,' is concerning. Although currently unpatched, this history suggests a recurring weakness that requires careful monitoring and prompt patching of any future vulnerabilities.

In conclusion, the plugin has several strong security features, including a well-protected attack surface and good output escaping. Nevertheless, the use of raw SQL and, more critically, the absence of nonce checks on API endpoints, coupled with a history of critical vulnerabilities, indicate potential weaknesses that need addressing. Proactive security measures, such as implementing prepared statements for all SQL queries and adding nonce checks to its API routes, are recommended.