Devs CRM – Manage tasks, attendance and teams all together Security & Risk Analysis

The "devs-crm" plugin v1.1.9 exhibits a mixed security posture. On the positive side, the plugin demonstrates strong adherence to secure coding practices regarding SQL queries, utilizing prepared statements exclusively, and ensuring all output is properly escaped. The presence of numerous nonce and capability checks also indicates an awareness of WordPress security best practices.

However, significant concerns arise from the attack surface analysis. The plugin exposes 54 REST API routes, with a notable 2 routes lacking permission callbacks. This creates a direct entry point for unauthenticated users to interact with potentially sensitive functionality. The taint analysis, while reporting zero flows, may not be comprehensive if not all entry points were thoroughly analyzed for potential taint. The plugin's vulnerability history is particularly concerning, with 2 currently unpatched medium severity CVEs, both attributed to missing authorization. This pattern suggests a recurring weakness in how the plugin handles user permissions, which is a critical aspect of web application security.

In conclusion, while the plugin has strengths in its handling of database queries and output, the identified unpatched vulnerabilities and the presence of unprotected REST API endpoints represent significant security risks. The recurring theme of missing authorization in past vulnerabilities demands immediate attention. The plugin requires urgent remediation of its unpatched CVEs and a thorough review of its REST API endpoints to ensure proper authorization checks are in place.