Fabrica Dashboard Security & Risk Analysis

The "fabrica-dashboard" v1.0.18 plugin presents a significant security risk due to its large, unprotected attack surface. All 12 identified AJAX handlers lack authentication checks, meaning any authenticated user could potentially trigger these actions, leading to unauthorized operations. While the plugin demonstrates good practices in SQL query preparation and output escaping, the absence of nonces on AJAX actions is a critical oversight. This lack of protection against Cross-Site Request Forgery (CSRF) is a major concern. The plugin's vulnerability history is clean, with no recorded CVEs. This, combined with the well-handled SQL and output functions, suggests a potential for good coding practices in some areas. However, the current implementation of AJAX endpoints renders these strengths largely moot, as the fundamental security of these entry points is compromised.