AZEXO Advertising Analytics Security & Risk Analysis

The "azexo-advertising-analytics" v1.27.3 plugin exhibits significant security concerns despite a clean vulnerability history. The static analysis reveals a large attack surface with 20 AJAX handlers lacking authentication checks, posing a substantial risk of unauthorized actions. While there are no known CVEs, this absence might indicate a lack of rigorous historical security auditing rather than inherent security. The code's reliance on raw SQL queries (only 2% using prepared statements) combined with multiple taint flows identified as having unsanitized paths (specifically 2 high-severity flows) points to potential vulnerabilities like SQL injection or data leakage. The limited use of nonce and capability checks further exacerbates the risk posed by the unprotected AJAX endpoints. The plugin does demonstrate strengths in output escaping (79% properly escaped) and avoids file operations and external HTTP requests, which are positive indicators. However, the numerous unprotected entry points and the presence of high-severity taint flows are critical weaknesses that overshadow these strengths, indicating a need for immediate attention and remediation.