Fast MailerLite Security & Risk Analysis

The "fast-mailerlite" v1.1.3 plugin exhibits several concerning security practices, despite a clean vulnerability history. The most significant issue is the presence of two AJAX handlers that lack any authentication or capability checks. This creates a substantial attack surface, as unauthorized users could potentially trigger these handlers, leading to unintended actions or information disclosure. The use of the `unserialize` function, a known risk if not handled with extreme care regarding input source, also raises a red flag. Although the taint analysis did not reveal critical or high severity flows, the existence of a flow with unsanitized paths warrants attention, indicating potential for vulnerabilities if the input is not properly validated. The plugin's strong reliance on external HTTP requests (11) also introduces a dependency on the security of those external services. However, the plugin does demonstrate some good practices, such as a relatively high percentage of SQL queries using prepared statements and a good rate of output escaping. The absence of any recorded CVEs is a positive sign, suggesting that, to date, no publicly known vulnerabilities have been discovered. Overall, while the lack of past vulnerabilities is encouraging, the identified code-level weaknesses, particularly the unprotected AJAX endpoints, necessitate careful consideration and mitigation.