ForumWP – Forum & Discussion Board Security & Risk Analysis

The plugin "forumwp" v2.1.8 exhibits a mixed security posture. While it demonstrates strong practices in output escaping (99% proper) and uses prepared statements for a significant portion of its SQL queries (68%), there are notable areas of concern. The substantial attack surface, particularly the 60 unprotected AJAX handlers, presents a significant risk. Taint analysis reveals two high-severity flows with unsanitized paths, indicating potential vulnerabilities that could be exploited if these flows are triggered by malicious input. The plugin's history of six known CVEs, including one critical and one high severity, is a major red flag. Although currently no CVEs are unpatched, the pattern of past vulnerabilities like missing authorization, deserialization, and XSS suggests recurring security weaknesses that require careful attention. The plugin has demonstrated strengths in output handling and SQL query preparation, but the large number of unprotected entry points and past critical vulnerabilities necessitate caution.