CF7NXT Lite – Contact Form 7 Save Into Database Plugin By Witoni Software Security & Risk Analysis

The "cf7-save-into-database" v1.0 plugin exhibits several concerning security practices, significantly outweighing its strengths. A primary concern is the presence of an AJAX handler without any authentication checks, creating a direct entry point for potential attackers. Furthermore, the plugin's reliance on raw SQL queries with zero use of prepared statements is a major red flag, leaving it highly susceptible to SQL injection vulnerabilities. The high number of unsanitized taint flows, although not classified as critical or high severity in this analysis, still indicates potential pathways for malicious data to be processed without proper validation. The limited output escaping (29%) also suggests potential for cross-site scripting (XSS) vulnerabilities.

While the plugin has no recorded vulnerability history (CVEs), this should not be interpreted as a guarantee of security. The static analysis results reveal fundamental weaknesses in how the plugin handles user input and interacts with the database. The presence of dangerous functions like `unserialize` further exacerbates the risk, especially when combined with unsanitized input. The lack of capability checks on entry points is also a significant oversight. In conclusion, the plugin's current security posture is poor due to these critical vulnerabilities, and it should be treated with extreme caution until these issues are addressed.