CHEQ Essentials Security & Risk Analysis

The "cheq-essentials-go-to-market-security" v1.13 plugin exhibits significant security concerns primarily due to its attack surface, with all seven identified AJAX handlers lacking authentication checks. While the plugin demonstrates good practices in other areas, such as using prepared statements for all SQL queries and performing output escaping on a majority of outputs, the unprotected AJAX endpoints present a substantial risk. Taint analysis showed four flows with unsanitized paths, although these did not reach critical or high severity, this still indicates a potential for vulnerabilities if data is not properly handled. The absence of any recorded vulnerability history is a positive sign, suggesting past development has been secure, but it does not negate the current risks identified in the static analysis. The plugin's reliance on external HTTP requests also warrants attention for potential vulnerabilities related to insecure handling of responses or data sent to external services.