WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin Security & Risk Analysis

The 'cf7-zoho' plugin version 1.3.3 presents a mixed security posture. While the static analysis indicates a very small attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events that lack authentication or permission checks, there are concerning signals within the code itself. The presence of the `unserialize` function, a known source of deserialization vulnerabilities, without explicit checks for untrusted input is a significant red flag. Although no critical or high severity taint flows were found, this function's usage could potentially be exploited if data intended for serialization is manipulated by an attacker. Furthermore, while a majority of SQL queries use prepared statements and a good percentage of output is properly escaped, the remaining portions suggest potential for SQL injection and cross-site scripting vulnerabilities if not handled carefully in all cases.

The plugin's vulnerability history is a major concern, with five known CVEs recorded, including one critical, one high, and three medium. The types of past vulnerabilities (Deserialization of Untrusted Data, SQL Injection, CSRF, XSS) align with the types of weaknesses that could be introduced by the identified code signals. The fact that the last vulnerability was dated in the near future (2025-06-16) suggests a pattern of past security flaws, even if none are currently marked as unpatched. This history indicates a need for diligent review and patching of any future discovered vulnerabilities.

In conclusion, while the plugin has a small attack surface and shows some good practices like the use of prepared statements and nonces, the presence of `unserialize` and a history of serious vulnerabilities necessitate caution. The code signals and historical data suggest potential for significant security issues if not addressed proactively. Continued vigilance and code auditing are recommended.