Click & Pledge WPJobBoard Security & Risk Analysis

The "click-pledge-wpjobboard" plugin exhibits a mixed security posture. While it shows strengths in its use of prepared statements for SQL queries and proper output escaping, significant concerns are raised by the lack of authentication and capability checks on all identified AJAX handlers. The presence of 24 unprotected AJAX entry points is a substantial risk, as it means any unauthenticated user could potentially trigger these functions, leading to unintended actions or information disclosure.

Taint analysis reveals 7 flows with unsanitized paths, 4 of which are of high severity. This, coupled with the complete absence of nonce checks on AJAX actions, strongly suggests a vulnerability to cross-site request forgery (CSRF) or similar attacks that could exploit these unprotected entry points. The plugin's history of a high severity SQL injection vulnerability, although currently patched, also indicates a past weakness in how user-supplied data was handled, reinforcing the concern about unsanitized input in the current version.

In conclusion, the plugin has adopted some good security practices like prepared statements and output escaping. However, the massive attack surface exposed through unprotected AJAX handlers and the critical findings in taint analysis present a clear and present danger. The historical SQL injection vulnerability further highlights the need for rigorous input validation and authorization checks on all entry points. Until these critical authorization and sanitization issues are addressed, the plugin remains a significant security risk.