Contact form builder for Gutenberg – Formello Security & Risk Analysis

The Formello v2.7.1 plugin exhibits a generally strong security posture, adhering to several best practices such as 100% output escaping and a high percentage of prepared SQL statements. The absence of known CVEs and a clean vulnerability history are positive indicators of the developer's commitment to security. However, the plugin does present some concerning security weaknesses that warrant attention. Specifically, the presence of two AJAX handlers without authentication checks creates a direct attack vector for unauthorized actions. Additionally, the taint analysis revealed two flows with unsanitized paths, which, while not flagged as critical or high severity in this analysis, represent a potential risk if these paths are reachable by unauthenticated users or if the data involved is sensitive. The limited file operations and external HTTP requests are also good points, but the two unprotected entry points and the potential for unsanitized path traversals are the primary areas of concern.