DT LMS – elearning, WordPress LMS Plugin Security & Risk Analysis

The "dt-lms-lite" v1.1 plugin exhibits a mixed security posture. While it demonstrates strong practices in its SQL query handling, with 100% using prepared statements, and a high percentage of properly escaped output, significant concerns arise from its attack surface. A substantial number of AJAX handlers (46 out of 56) are exposed without authentication checks. This presents a considerable risk, as unauthenticated users could potentially interact with these handlers, leading to unintended actions or information disclosure depending on their functionality.

The taint analysis reveals a high number of flows with unsanitized paths (28 out of 31), though critically, no high or critical severity issues were identified from these. This suggests potential for basic injection vulnerabilities or unexpected behavior if these unsanitized paths are user-controlled, but the lack of critical findings is a positive sign. The plugin's vulnerability history is clean, with no recorded CVEs, which is an excellent indicator of past security diligence. However, this lack of historical vulnerabilities should not overshadow the immediate risks identified in the static analysis, particularly the unprotected AJAX endpoints.

In conclusion, the plugin has strengths in data integrity (SQL) and output sanitization. Nevertheless, the unprotected AJAX handlers constitute a significant security weakness that requires immediate attention. The high number of unsanitized paths in the taint analysis, while not leading to critical issues in this version, warrants careful review to prevent future vulnerabilities. The absence of historical vulnerabilities is a positive but should not be the sole basis for assessing current risk.