Booking Works Security & Risk Analysis

The booking-works plugin version 1.0.4 presents a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and has no recorded vulnerability history, suggesting a potentially well-maintained codebase.

However, significant concerns arise from the static analysis. A large portion of the plugin's attack surface, specifically 10 AJAX handlers, lacks authentication checks. While there are 4 nonce and 4 capability checks, their distribution across 17 entry points, with 10 being unprotected, is a substantial risk. The taint analysis also revealed 5 flows with unsanitized paths, although thankfully none were classified as critical or high severity.

Despite the absence of known CVEs and the use of prepared statements, the presence of numerous unprotected AJAX endpoints and unsanitized paths creates a considerable risk of unauthorized actions or potential vulnerabilities. The plugin's strengths in SQL handling are overshadowed by its weaknesses in input validation and access control for its AJAX endpoints.