Database Addon For WPForms ( wpforms entries ) – WPFormsDB Security & Risk Analysis

The plugin "database-for-wpforms" v1.1.0 exhibits a generally good security posture with a zero-attack surface for entry points like AJAX, REST API, and shortcodes. The absence of known CVEs and a clean vulnerability history are positive indicators. However, the presence of 8 instances of the "unserialize" function is a significant concern, as unserialization of untrusted data is a common vector for remote code execution vulnerabilities. While the taint analysis didn't flag critical or high severity issues in the analyzed flows, the "unsanitized paths" flow suggests potential for unexpected behavior if data is not handled meticulously throughout the application. The SQL query preparedness rate of 29% is also concerning, indicating a reliance on raw SQL queries that could be susceptible to SQL injection if input is not properly sanitized and validated before being used in these queries.

Overall, the plugin demonstrates strengths in its limited attack surface and clean history. Nevertheless, the identified "unserialize" usage and the lower-than-ideal prepared statement usage for SQL queries present notable risks that require careful attention and mitigation. The plugin would benefit from a thorough review of all "unserialize" calls and improved practices for SQL query construction to further enhance its security.