CM Pop-Up – Create engaging popups to capture attention and boost interaction Security & Risk Analysis

The 'cm-pop-up-banners' plugin v1.8.5 presents a mixed security posture. While it utilizes some good practices like nonce checks and capability checks, these are applied inconsistently across its attack surface. A significant concern is the high number of unprotected AJAX handlers, which represent a direct entry point for attackers to potentially exploit. The presence of the 'unserialize' function, especially without clear sanitization context, is a red flag that could lead to deserialization vulnerabilities. Furthermore, a notable percentage of SQL queries are not using prepared statements, increasing the risk of SQL injection.

The plugin's vulnerability history is a major area of concern. With 5 known CVEs, including one high-severity vulnerability, and common types like missing authorization, XSS, and SQL injection, it indicates a recurring pattern of security weaknesses. Although there are currently no unpatched CVEs, the historical prevalence of these vulnerability types suggests a need for more robust security development practices. The taint analysis, while showing no critical or high severity flows, still found one unsanitized path, reinforcing the need for careful input validation and sanitization throughout the codebase.

In conclusion, the plugin exhibits several weaknesses, particularly regarding authorization on its AJAX endpoints, potential deserialization risks due to 'unserialize,' and a concerning history of past vulnerabilities. While some security measures are in place, the overall security posture requires improvement. The presence of unprotected entry points and past security incidents suggest that users should exercise caution and ensure the plugin is updated to the latest, most secure version if available, and monitor for future security advisories.