Custom Posts Order Security & Risk Analysis

The custom-posts-order plugin v4.4 presents a mixed security posture. While it has a seemingly small attack surface with no reported AJAX handlers or REST API routes that lack authentication, and a single shortcode as its only entry point, the code analysis reveals significant concerns. A notable red flag is the presence of SQL queries that are not using prepared statements, alongside a concerning number of taint flows with unsanitized paths, specifically two classified as high severity. This indicates potential for data injection or manipulation vulnerabilities.

The plugin's vulnerability history is also a cause for concern. Having one known CVE, which is currently unpatched, and a medium severity rating, suggests a pattern of past security weaknesses. The common vulnerability type of Cross-Site Request Forgery (CSRF) indicates a potential for users to be tricked into performing unintended actions. Although the plugin demonstrates some strengths, like a majority of outputs being properly escaped, the combination of unsanitized taint flows and unpatched vulnerabilities creates a tangible risk that requires attention.