DoLeads Integrator Security & Risk Analysis

The "doleads-integrator" v1.2.2 plugin presents a significant security risk due to its large attack surface of unprotected AJAX handlers. All 12 AJAX entry points lack authentication and authorization checks, meaning any authenticated user could potentially trigger these functions. While the plugin doesn't appear to have a history of publicly disclosed vulnerabilities, this is not a guarantee of current security. The static analysis indicates potential issues with unsanitized paths in taint analysis, specifically two flows identified as high severity. This, coupled with the absence of nonce checks and capability checks on AJAX actions, creates a fertile ground for various attacks, including Cross-Site Request Forgery (CSRF) and potentially more severe vulnerabilities if these unsanitized paths lead to unintended code execution or data leakage. The SQL queries are moderately protected with prepared statements, and output escaping is generally good, but these strengths are overshadowed by the critical lack of input validation and authorization on the AJAX endpoints. The single file operation and external HTTP request also warrant scrutiny in conjunction with the unsanitized paths. Overall, the plugin has several fundamental security weaknesses that require immediate attention.