click5 CRM add-on to Ninja Forms Security & Risk Analysis

This plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and a very high percentage of properly escaped output, minimizing risks of SQL injection and cross-site scripting (XSS) from output. The absence of dangerous functions, file operations, and known vulnerabilities in its history are also strong indicators of a generally well-developed plugin.

However, significant concerns arise from the identified attack surface. The plugin exposes 9 REST API routes with no permission callbacks, meaning any user, regardless of their role or authentication status, can potentially interact with these endpoints. This presents a substantial risk, as these endpoints could be leveraged for various attacks if they perform sensitive actions or expose private data. The complete lack of nonce checks on AJAX handlers, while there are no AJAX handlers in this specific version, still indicates a potential future oversight if AJAX functionality is added. The single external HTTP request also warrants careful scrutiny for potential vulnerabilities.

Overall, while the plugin's internal code quality regarding SQL and output escaping is commendable, the exposed REST API endpoints without proper authorization are a critical security weakness. The absence of historical vulnerabilities is a positive sign, but it cannot compensate for the current, exploitable attack surface. Users should be highly cautious with this plugin until the REST API endpoints are secured with appropriate permission checks.