Call Now Button – The #1 Click to Call Button for WordPress Security & Risk Analysis

The "call-now-button" v2.0.0 plugin presents a mixed security posture. On the positive side, it demonstrates good practices in SQL query handling, with 100% of queries using prepared statements, and a very high percentage of output being properly escaped. The absence of critical or high-severity taint analysis findings and a lack of file operations are also strengths. However, a significant concern lies in its attack surface. With 17 AJAX handlers, a substantial 15 of them lack any form of authentication checks, exposing them to unauthorized access and potential abuse. This wide, unprotected entry point is a major risk.

The vulnerability history reveals a pattern of medium-severity issues, including Missing Authorization, CSRF, and XSS. While there are no currently unpatched vulnerabilities, the existence of 5 past medium-severity CVEs, particularly those related to authorization and input sanitization, reinforces the risks introduced by the unprotected AJAX endpoints. The common types of past vulnerabilities directly correlate with the areas of weakness identified in the static analysis, suggesting a recurring theme of insufficient input validation and access control in certain plugin functionalities.

In conclusion, while the plugin employs good practices in SQL and output handling, the large number of unprotected AJAX endpoints creates a significant security risk. Coupled with a history of medium-severity vulnerabilities related to authorization and XSS, careful attention to securing these entry points and ongoing security monitoring are strongly recommended. The lack of critical flaws is encouraging, but the exposed attack surface is a clear and present danger.