Coupon API Security & Risk Analysis

The "couponapi" plugin version 6.2.14 exhibits a concerning security posture due to multiple unprotected entry points. The static analysis reveals a significant attack surface with 4 out of 4 identified entry points (AJAX handlers and REST API routes) lacking proper authorization checks. This means any unauthenticated user could potentially interact with these sensitive functions. While the code shows some good practices like the use of prepared statements in SQL queries and some output escaping, the lack of capability checks is a major red flag. The taint analysis, while not revealing critical or high severity flows, shows a number of unsanitized paths, which, combined with the unprotected entry points, could lead to vulnerabilities if malicious input is provided. The plugin's vulnerability history is also a significant concern, with one known unpatched medium-severity CVE related to SQL injection. This history, coupled with the current lack of authorization checks, suggests a pattern of past weaknesses that may not have been fully addressed, posing a continued risk to sites using this version.