AZEXO Store Locator Security & Risk Analysis

The azexo-store-locator plugin v1.4 exhibits a mixed security posture. On the positive side, it demonstrates strong practices regarding SQL queries, utilizing prepared statements exclusively, and generally good output escaping. The absence of known CVEs and external HTTP requests further contributes to its perceived stability. However, a significant concern arises from the large attack surface, particularly the high number of AJAX handlers that lack authentication checks. This presents a direct pathway for unauthenticated attackers to interact with potentially sensitive plugin functionalities. Additionally, the taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for vulnerabilities that could be exploited through user-controlled input, even if these have not yet manifested as publicly known CVEs. While the lack of historical vulnerabilities is encouraging, it does not negate the risks identified in the static analysis. Overall, the plugin has solid coding fundamentals but requires immediate attention to its unauthenticated AJAX endpoints and the identified taint flows to improve its security.