Friends Security & Risk Analysis

The "friends" v3.6.0 plugin demonstrates a mixed security posture. On the positive side, it shows strong adherence to secure coding practices with 100% of SQL queries using prepared statements and a high percentage (95%) of output properly escaped. The presence of numerous nonce and capability checks (54 and 43 respectively) is also a significant strength, indicating an effort to protect against common WordPress attacks. The absence of any currently unpatched CVEs is a good sign, suggesting active maintenance regarding known security issues.

However, several areas raise concerns. The presence of one AJAX handler without authentication checks, despite a generally good number of capability checks, represents a direct entry point for potential unauthorized actions. The static analysis also flagged the use of the `unserialize` function, which is notoriously dangerous when processing untrusted data and could lead to deserialization vulnerabilities if not handled with extreme care and strict input validation. The vulnerability history, while having no currently unpatched critical issues, reveals a pattern of past vulnerabilities including deserialization, missing authorization, and SSRF. This history, particularly the presence of high and medium severity vulnerabilities in the past, suggests that the plugin may have recurring security weaknesses that require vigilant monitoring and secure coding practices.

In conclusion, while "friends" v3.6.0 benefits from good practices in SQL and output handling, the unprotected AJAX handler and the `unserialize` function are immediate static analysis concerns. The past vulnerability record, especially for deserialization and authorization, necessitates a cautious approach. Users should be aware of these potential weaknesses and ensure the plugin is updated promptly if future vulnerabilities are discovered.