Обратный звонок Security & Risk Analysis

The 'call-me-spoot' plugin version 1.4 presents a significant security risk due to multiple unauthenticated entry points and poor output escaping practices. The static analysis revealed two AJAX handlers, both of which lack authentication checks. This means any unauthenticated user could potentially trigger these handlers, leading to unintended actions or information disclosure.

While the plugin utilizes prepared statements for SQL queries, which is a strength, the overwhelmingly low percentage of properly escaped output (13%) is a major concern. This indicates a high likelihood of cross-site scripting (XSS) vulnerabilities, where malicious code could be injected into the website's output. The presence of `create_function`, while less critical on its own, can also be a vector for code injection if not handled with extreme care. The absence of any recorded vulnerability history is positive but does not negate the inherent risks identified in the code analysis.

In conclusion, the plugin's security posture is weak. The unauthenticated AJAX handlers and severe output escaping deficiencies create substantial risks. While good practices like prepared statements are present, they are overshadowed by critical vulnerabilities that require immediate attention. The plugin's attack surface is small but poorly secured.