Contact Form 7 Cost Calculator (Add-on for CF7) Security & Risk Analysis

The "cf7-cost-calculator" v1.0.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, utilizing prepared statements exclusively, and has no recorded vulnerabilities or CVEs, suggesting a relatively stable and well-maintained code base in its history. There are also no reported issues with dangerous functions, file operations, external HTTP requests, or bundled libraries.

However, significant concerns arise from the static analysis. The plugin has a total of one entry point, an AJAX handler, which critically lacks any authentication or capability checks. This directly exposes a significant part of the plugin's functionality to unauthenticated users, creating a substantial attack surface. Furthermore, while the majority of output is properly escaped, a notable percentage (36%) is not, which could lead to Cross-Site Scripting (XSS) vulnerabilities if the unsanitized data originates from user input.

The lack of taint analysis results is neutral; it doesn't confirm safety but doesn't highlight specific flaws either. The absence of nonce checks on the identified AJAX handler is a critical oversight. In conclusion, while the plugin benefits from a clean vulnerability history and secure SQL practices, the unprotected AJAX handler and potential for unescaped output present immediate and significant security risks that require urgent attention.