BusinessPress Security & Risk Analysis

The businesspress plugin v1.5 presents a mixed security posture. While it boasts a clean vulnerability history with no recorded CVEs and a good percentage of SQL queries using prepared statements, significant concerns arise from the static analysis. The plugin has a notable attack surface with seven AJAX handlers, four of which lack authentication checks. This immediately introduces a risk of unauthorized actions if these handlers can be triggered by unauthenticated users. Furthermore, the taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for code injection or path traversal vulnerabilities. Coupled with a low percentage of properly escaped output (39%), these findings suggest a lack of robust input validation and output sanitization in critical areas.