Formit – The Ultimate drag and drop WordPress Form Builder Security & Risk Analysis

The FormIt v2.1.4 plugin exhibits a generally strong security posture, with excellent practices observed in SQL query handling and output escaping, both of which are 100% compliant with best practices. The absence of known CVEs and a clean vulnerability history are positive indicators. However, there are notable areas for improvement, particularly concerning the plugin's attack surface. The presence of four AJAX handlers without authentication checks represents a significant risk, as these could potentially be exploited by unauthenticated users. Additionally, the taint analysis revealed two flows with unsanitized paths, which, while not classified as critical or high severity by the analysis, warrant further investigation as they indicate potential pathways for data manipulation or injection if not properly mitigated at the application level. The plugin also demonstrates a good number of nonce and capability checks, but the unprotected entry points are a concern that could be addressed by implementing these checks more consistently across all handlers.