Bridhy – No-code Drag & Drop Form Builder for Contact Form 7 Security & Risk Analysis

The "bridhy-addons-for-contact-form-7" plugin v1.0.1 exhibits a generally good security posture, with a very small attack surface and a high percentage of properly escaped outputs. The absence of known CVEs and zero recorded vulnerabilities in its history are positive indicators of developer diligence. However, the static analysis reveals a few areas for improvement.

The primary concern is the presence of the `unserialize` function, which can be a significant security risk if used with untrusted input, potentially leading to Remote Code Execution (RCE) vulnerabilities. While no taint flows were found to be unsanitized in the analyzed paths, the mere presence of this function warrants caution. Additionally, the plugin performs file operations and uses SQL queries with a significant portion not employing prepared statements, which could be exploited in certain scenarios. The lack of capability checks for its single shortcode is also a notable weakness.

Despite these concerns, the plugin's small attack surface, high output escaping rate, and clean vulnerability history suggest it is likely not actively malicious or riddled with widespread vulnerabilities. The core risk stems from the potential misuse of `unserialize` and the less secure SQL queries. Addressing these specific code signals and implementing capability checks would significantly bolster its security.