Blocked in China | Check if your site is available in the Chinese mainland Security & Risk Analysis

The "blocked-in-china" plugin version 1.1.5 demonstrates a mixed security posture. On the positive side, it shows good practices regarding SQL queries, utilizing prepared statements exclusively, and a high percentage of properly escaped output. The absence of known CVEs and a clean vulnerability history are strong indicators of a developer attentive to security.

However, the plugin presents significant concerns related to its attack surface. A notable portion of its AJAX handlers (4 out of 11) and one REST API route lack proper authentication or permission checks. This exposes these entry points to potential unauthorized access and manipulation, which could lead to various security issues depending on the functionality of these handlers. While the taint analysis did not reveal immediate critical or high-severity vulnerabilities, the unprotected entry points remain a primary risk.

In conclusion, while the underlying code quality for database interactions and output handling is commendable, the exposure of critical functionalities through unprotected entry points is a substantial weakness. The plugin has a good track record of security, but the current static analysis highlights a potential for attackers to exploit unauthenticated endpoints. Developers should prioritize securing all AJAX and REST API endpoints.