Evadav Security & Risk Analysis

The "evadav" v1.0.0 plugin exhibits a concerning security posture due to a significant attack surface with no authentication checks on its AJAX handlers. The static analysis reveals that all 6 AJAX entry points lack authorization, making them prime targets for unauthorized actions. Furthermore, the plugin's SQL query handling is a major weakness, with 100% of queries not using prepared statements, which is a significant risk for SQL injection vulnerabilities. Taint analysis also highlights 3 flows with unsanitized paths, two of which are classified as high severity, indicating potential for malicious data to be processed and lead to exploits. The absence of nonce checks on these unprotected AJAX handlers further exacerbates these risks.

Despite these critical code-level issues, the plugin has no recorded vulnerability history, which is a positive indicator in isolation. However, this lack of historical data does not negate the immediate risks identified through static and taint analysis. The plugin's strengths lie in its lack of file operations and external HTTP requests, as well as a single capability check, but these are overshadowed by the critical vulnerabilities in its input handling and data processing. Overall, "evadav" v1.0.0 presents a high-risk profile requiring immediate attention to secure its AJAX endpoints and address its insecure SQL practices.