Bens Email Marketing & Automation Security & Risk Analysis

The "bens-email-marketing-automation" plugin v1.0.19 presents a mixed security posture. While the plugin boasts a clean vulnerability history with no recorded CVEs, indicating potential good development practices or infrequent security audits, the static analysis reveals areas of concern. A significant attack surface exists with 42 AJAX handlers, and critically, 4 of these lack proper authentication checks. This opens the door for unauthenticated attackers to trigger potentially harmful actions. Furthermore, the plugin exclusively uses raw SQL queries without prepared statements, posing a risk of SQL injection vulnerabilities. Although taint analysis shows no critical or high-severity unsanitized paths, the presence of 6 flows with unsanitized paths warrants attention, especially in conjunction with the lack of prepared statements.