Closemarketing Custom Admin Security & Risk Analysis

The "closemarketing-custom-admin" plugin version 1.12.1 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL queries, exclusively using prepared statements, and boasts a high percentage of properly escaped output, mitigating common injection and cross-site scripting risks. The absence of known CVEs and a clean vulnerability history further contribute to its perceived security. However, significant concerns arise from the attack surface analysis. The plugin exposes two AJAX handlers, both of which lack authentication checks, creating a direct entry point for potential malicious actions without proper user authorization. While no dangerous functions or unsanitized taint flows were detected, the presence of unprotected AJAX endpoints is a critical oversight that could be exploited if these handlers perform sensitive operations.