Event Organiser Security & Risk Analysis

The "event-organiser" plugin version 3.12.8 exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation (69%) and output escaping (68%), and implements a reasonable number of nonce and capability checks, there are significant concerns related to its attack surface and historical vulnerabilities. A notable portion of its AJAX handlers (8 out of 11) lack authentication checks, presenting a broad entry point for potential attacks. The presence of the `unserialize` function, coupled with taint analysis revealing 3 high-severity flows with unsanitized paths, further amplifies these concerns, suggesting potential for remote code execution or data manipulation if these flows are reachable without proper validation.

The plugin's vulnerability history, though appearing to have a single medium-severity CVE, is problematic due to its recency (December 2025) and the fact that it is currently unpatched. This indicates a persistent security weakness that has not been addressed, and the common vulnerability type of 'Missing Authorization' aligns with the static analysis findings of unprotected AJAX handlers. While the plugin has strengths in secure coding practices for SQL and output, the combination of a large unprotected attack surface, the dangerous `unserialize` function, high-severity unsanitized taint flows, and an unpatched historical vulnerability creates a concerning risk profile.