Constant Contact Forms by MailMunch Security & Risk Analysis

The 'constant-contact-forms-by-mailmunch' plugin version 2.1.6 presents a mixed security posture. While it demonstrates good practices by exclusively using prepared statements for SQL queries and includes a reasonable number of nonce and capability checks, significant concerns arise from its attack surface. A substantial portion of its AJAX handlers (5 out of 5) lack authentication checks, creating potential entry points for unauthorized actions. Furthermore, the presence of the `unserialize` function, a known risky function, without explicit context on its usage and sanitization, is a notable red flag. The plugin's vulnerability history, with 3 medium-severity CVEs historically, and common types including XSS and CSRF, suggests a past susceptibility to common web vulnerabilities. Although no currently unpatched CVEs are listed, the pattern of past vulnerabilities warrants caution. The taint analysis did not reveal critical or high-severity unsanitized paths, which is a positive sign, but the overall risk is elevated by the unprotected AJAX endpoints and the presence of `unserialize`.