CM E-Mail Blacklist – Simple email filtering for safer registration Security & Risk Analysis

The "cm-email-blacklist" v1.6.4 plugin exhibits a mixed security posture. On the positive side, it makes good use of prepared statements for SQL queries and includes nonce checks on some entry points. However, significant concerns arise from its attack surface, particularly with three out of four AJAX handlers lacking authentication checks, making them vulnerable to unauthorized actions. Additionally, while the taint analysis shows no critical or high severity flows, one flow with an unsanitized path warrants attention for potential injection vulnerabilities. The plugin's vulnerability history, with three previously disclosed medium-severity CVEs for Cross-Site Scripting and CSRF, and the most recent vulnerability dated in the future (implying potential for future undiscovered issues or misrepresentation), suggests a pattern of past security weaknesses that, while currently patched, could indicate ongoing development or maintenance practices that may overlook certain security considerations.