SMTP by BestWebSoft Security & Risk Analysis

The BWS SMTP plugin v1.2.0 exhibits a mixed security posture. On the positive side, the static analysis reveals a relatively small attack surface with no exposed REST API routes or shortcodes, and importantly, no unprotected AJAX handlers. The code also demonstrates good practices in output escaping, with 97% of outputs properly escaped, and a strong emphasis on nonce and capability checks. However, there are areas for concern. The plugin utilizes raw SQL queries in half of its instances, which presents a risk if not handled with extreme care. Additionally, the history of known vulnerabilities, including a high-severity Cross-Site Scripting (XSS) and an Unrestricted File Upload vulnerability, is a significant red flag, even though none are currently unpatched. The recurrence of these types of vulnerabilities suggests potential underlying coding weaknesses that could resurface.