Download After Email – Subscribe & Download Form Plugin Security & Risk Analysis

The 'download-after-email' plugin v2.1.9 presents a mixed security posture with several concerning areas despite some good practices. The plugin demonstrates a strong adherence to secure coding practices concerning SQL queries and output escaping, with 96% and 98% respectively being properly handled. It also incorporates a reasonable number of nonce and capability checks. However, a significant concern arises from the attack surface, where 4 out of 10 AJAX handlers lack authentication checks, leaving them vulnerable to unauthorized access and potential exploitation. The taint analysis, while not revealing critical or high severity issues, did identify 2 high-severity flows with unsanitized paths, indicating a risk of sensitive data handling or execution pathways being compromised if not properly validated.

The vulnerability history reveals a pattern of medium severity issues, specifically related to missing authorization and uncontrolled resource consumption. The presence of an unpatched CVE, even if medium severity, is a direct and ongoing risk that cannot be ignored. The fact that the last vulnerability was recent (2026-01-24) suggests ongoing security challenges with this plugin. Overall, while the plugin has strengths in its core coding practices, the unprotected AJAX endpoints, taint flow concerns, and unpatched vulnerability significantly increase its risk profile.