Contact List – Online Staff Directory & Address Book Security & Risk Analysis

The "contact-list" plugin v3.0.18 presents a mixed security posture. While it demonstrates some good practices such as a high percentage of properly escaped outputs and a decent number of nonce and capability checks, significant concerns arise from its attack surface. A notable 8 out of 15 entry points are AJAX handlers without any authentication checks, creating a broad avenue for potential unauthorized actions. Furthermore, the taint analysis reveals 6 critical flows with unsanitized paths, indicating a high risk of severe vulnerabilities like Cross-Site Scripting (XSS) or insecure direct object references if these flows are not properly handled.

The vulnerability history shows 2 known medium-severity CVEs, with the most recent being in May 2024. While there are no currently unpatched vulnerabilities, the historical presence of Missing Authorization and XSS issues, coupled with the current taint analysis findings, suggests a pattern of recurring security weaknesses that require diligent attention. The presence of the Freemius v1.0 bundled library, while not explicitly flagged as outdated, warrants monitoring for potential vulnerabilities in older versions.

In conclusion, the plugin has areas of strength, particularly in output escaping. However, the high number of unprotected AJAX handlers and the critical taint flows are significant security risks that demand immediate remediation. The historical vulnerability pattern further underscores the need for robust security practices to be consistently applied. The plugin's security can be significantly improved by implementing proper authentication and authorization checks on its exposed AJAX endpoints and thoroughly sanitizing all input involved in the identified taint flows.