Floating Admin Button Security & Risk Analysis

The 'floating-admin-button' plugin v1.1.2 presents a mixed security posture. On the positive side, it demonstrates good practices by not utilizing dangerous functions, performing all SQL queries using prepared statements, and having no recorded vulnerabilities or CVEs. However, significant concerns arise from its attack surface. The plugin exposes a single AJAX handler without any authentication or capability checks. While the taint analysis did not reveal critical or high severity unsanitized paths, the presence of two flows with unsanitized paths, coupled with the unprotected AJAX endpoint, creates a potential avenue for exploitation. This means an unauthenticated attacker could potentially trigger this AJAX handler and influence its execution.