Democracy Poll Security & Risk Analysis

The democracy-poll plugin v6.1.1 presents a mixed security posture. While it demonstrates some good practices, such as the use of nonces and capability checks in some areas and a moderate percentage of SQL queries using prepared statements, significant concerns remain. The presence of two AJAX handlers without authorization checks creates a direct attack vector for unauthenticated users. The taint analysis revealing three high-severity flows with unsanitized paths is particularly worrying, suggesting potential for code injection or data leakage if these flows are exploitable.

The plugin's vulnerability history is a strong indicator of ongoing security issues, with three known CVEs, one of which is currently unpatched. The common types of vulnerabilities (Missing Authorization, CSRF, XSS) align with the findings in the static analysis, particularly the unauthenticated AJAX handlers and the taint analysis results. The recency of the last vulnerability (April 2024) suggests that these issues may not be historical and could still be present or easily reintroduced. While the plugin has some strengths, the combination of unprotected entry points, critical taint flows, and a history of unpatched vulnerabilities necessitates a cautious approach.