Cyberpret – Calculettes Security & Risk Analysis

The "cyberpret-calculettes" v1.5.2 plugin exhibits a generally strong security posture based on the provided static analysis. The absence of dangerous functions, raw SQL queries, file operations, and external HTTP requests are positive indicators. The significant percentage of properly escaped output is also a good sign. The lack of any recorded vulnerabilities or CVEs in its history further suggests a mature and relatively secure development process. However, the analysis does reveal some areas for concern. A notable weakness is the complete absence of nonce checks and capability checks. While the attack surface of AJAX and REST API endpoints is reported as zero, the presence of 27 shortcodes as entry points without any form of authentication or authorization check presents a potential risk. If any of these shortcodes handle user-supplied input, the lack of these security mechanisms could lead to vulnerabilities.