EngageBay Add-on For Contact Form 7 Security & Risk Analysis

The plugin "engagebay-add-on-for-contact-form-7" v1.9.1 exhibits a mixed security posture. On the positive side, the static analysis reveals no identified dangerous functions, all SQL queries utilize prepared statements, and there are no recorded CVEs, suggesting a good track record and adherence to secure coding practices for database interactions. However, several areas raise concerns. The absence of nonce checks and capability checks, coupled with a high percentage of unsanitized taint flows (3 out of 3 analyzed), indicates potential vulnerabilities where user-supplied data might not be properly validated or authorized before being processed. Furthermore, while the attack surface appears small with zero identified entry points like AJAX handlers or REST API routes, this may be misleading if the plugin relies on external interactions or indirect input handling not captured in this analysis. The file operation and external HTTP requests also warrant scrutiny to ensure they are not being exploited.