CodeArt Units Converter Security & Risk Analysis

The 'codeart-units-converter' v3.4.0 plugin exhibits a mixed security posture. While the absence of known CVEs and the prevalent use of prepared statements for SQL queries are positive indicators, several significant security concerns arise from the static analysis. A substantial portion of the plugin's attack surface, specifically all 16 REST API routes, lacks any permission callbacks, exposing them to unauthenticated access. Furthermore, the taint analysis reveals four flows with unsanitized paths, although these did not reach critical or high severity levels. The complete absence of nonce checks across all entry points, including AJAX handlers (though none are explicitly listed as unprotected), is a notable weakness, potentially allowing for CSRF attacks if AJAX functionality exists and is not properly secured. The plugin also has no recorded vulnerability history, which is a good sign, but this does not negate the immediate risks identified in the code.