FluentChat – Live Chat for WordPress Security & Risk Analysis

The 'fluentchat-basic' v1.0.2 plugin exhibits a concerning security posture due to a large attack surface comprised entirely of unprotected AJAX handlers. The complete lack of authentication and authorization checks on these 23 entry points presents a significant risk, as any unauthenticated user could potentially interact with these functions, leading to unintended consequences or exploitability if further vulnerabilities exist within their implementation.

While the static analysis did not uncover critical or high-severity taint flows, it did reveal that 100% of the SQL queries are executed without prepared statements. This is a major concern, as it opens the door to SQL injection vulnerabilities, especially when combined with the unprotected AJAX endpoints. The low percentage of properly escaped output (44%) further exacerbates this risk, as it suggests potential for cross-site scripting (XSS) attacks. The plugin's history of zero known vulnerabilities might suggest a lack of public discovery or a relatively simple codebase, but it should not be interpreted as a guarantee of security, especially given the identified weaknesses.

In conclusion, 'fluentchat-basic' v1.0.2 has several critical security weaknesses. The unprotected AJAX handlers combined with raw SQL queries and insufficient output escaping create a high risk profile. While there are no recorded CVEs, the identified code-level issues necessitate immediate attention and remediation to ensure user data and site integrity.