Event Organiser Posterboard Security & Risk Analysis

The "event-organiser-posterboard" v3.0.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices in handling SQL queries, exclusively using prepared statements, and there are no recorded vulnerabilities or known CVEs, suggesting a history of stable and secure development. The absence of file operations and external HTTP requests further reduces potential attack vectors. However, the plugin presents significant concerns regarding its attack surface. With three entry points identified, two of which are unprotected AJAX handlers, there is a clear opportunity for attackers to interact with the plugin without proper authentication or authorization checks. The lack of capability checks and nonce checks on these handlers exacerbates this risk, leaving them vulnerable to unauthorized actions.