Contact Form Email Security & Risk Analysis

The 'contact-form-to-email' plugin v1.3.64 exhibits a mixed security posture. While it demonstrates some good practices such as a reasonable percentage of prepared SQL statements and proper output escaping, significant concerns remain. The presence of one unprotected AJAX handler directly exposes an entry point to potential unauthorized actions. Furthermore, the static analysis reveals the dangerous `unserialize` function, a known risk for deserialization vulnerabilities if not handled with extreme care, and the taint analysis indicates three high-severity flows with unsanitized paths, suggesting potential injection or information leakage vulnerabilities.

The plugin's historical vulnerability record is a major red flag, with 16 known CVEs and a significant number of high and medium severity issues. The common vulnerability types, including Authorization Bypass, Missing Authorization, and Cross-Site Scripting, point to recurring security flaws. The most recent vulnerability dating to late 2025 is concerning, even if currently unpatched ones are reported as zero. This history suggests a pattern of introducing vulnerabilities and indicates that past fixes may not have fully addressed the underlying architectural weaknesses.

In conclusion, while the plugin attempts some security measures, the combination of an unprotected AJAX endpoint, the use of `unserialize`, high-severity taint flows, and a history riddled with critical and high-severity vulnerabilities necessitates a cautious approach. The potential for both direct exploitation of unprotected entry points and more subtle vulnerabilities stemming from historical patterns makes this plugin a notable risk.