bStat Security & Risk Analysis

The "bstats" v6.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and having no recorded vulnerabilities in its history, suggesting a generally secure development process or minimal exposure. However, the static analysis reveals significant security concerns, primarily related to its attack surface. All six identified AJAX handlers lack authentication checks, presenting a substantial risk for unauthorized actions. Furthermore, while most outputs are properly escaped, the presence of one flow with an unsanitized path flagged as high severity taint is a critical concern that could lead to various security issues if exploited. The lack of capability checks on AJAX handlers exacerbates these risks, allowing any authenticated user, regardless of their role, to potentially interact with these vulnerable endpoints.