Contact Form 7 to Mailjet Security & Risk Analysis

The plugin 'cf7-to-mailjet' v1.8 demonstrates a generally good security posture with a zero attack surface from common entry points like AJAX, REST API, shortcodes, and cron events. The absence of known vulnerabilities, including critical or high severity ones, and the lack of recorded past issues is a strong positive indicator. The plugin also performs well in taint analysis, with no critical or high severity flows identified, suggesting inputs are handled with reasonable care.

However, the static analysis reveals a significant concern regarding SQL queries. All two SQL queries are executed without prepared statements, which is a major risk. This practice, especially if any of the data used in these queries originates from user input, could lead to SQL injection vulnerabilities. While the plugin has a nonce check and a capability check, and a high percentage of output is properly escaped, the unmitigated risk from raw SQL queries outweighs these positives. The plugin's historical lack of vulnerabilities is encouraging, but the identified SQL query pattern is a notable weakness that requires immediate attention.