Event Tickets and Registration Security & Risk Analysis

The "event-tickets" plugin version 5.27.5 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in several areas, including a high percentage of SQL queries using prepared statements (96%) and a strong adherence to output escaping (91%). The presence of numerous nonce and capability checks (62 and 104 respectively) also suggests an effort to implement security controls.

However, significant concerns arise from the substantial attack surface exposed without proper authorization. With 42 AJAX handlers, 21 lack authentication checks, and one of the REST API routes lacks permission callbacks, creating potential entry points for unauthorized actions. The presence of the `unserialize` function, a known risk vector for deserialization vulnerabilities, is also a point of concern. While taint analysis found no critical or high-severity issues, the presence of unsanitized paths in 6 out of 14 analyzed flows warrants attention.

The plugin's vulnerability history is a major red flag. A total of 11 known CVEs, with 2 high and 9 medium severity, indicate a recurring pattern of security weaknesses. The fact that the last vulnerability was recently discovered (2025-10-17) and there are currently no unpatched vulnerabilities suggests an ongoing effort to address issues, but the sheer volume and past severity of past vulnerabilities suggest a need for more robust initial security development.