FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Security & Risk Analysis

The fusewp plugin, version 1.1.25.0, exhibits a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and properly escaped output. The presence of numerous nonce and capability checks also indicates an effort to secure the application.

However, significant concerns arise from the static analysis. The plugin has a notable attack surface with three AJAX handlers, one of which lacks authentication checks, presenting a direct entry point for potential exploitation. Furthermore, the presence of the dangerous `unserialize` function is a red flag, as it can lead to remote code execution if not handled with extreme care. Taint analysis reveals six high-severity flows with unsanitized paths, suggesting potential vulnerabilities where user input could be used maliciously. The plugin's vulnerability history shows two medium-severity CVEs, both related to Missing Authorization and CSRF, which aligns with the observed lack of authentication on an AJAX handler.

While the plugin has no currently unpatched vulnerabilities and a good overall implementation of security features like prepared statements and output escaping, the identified unprotected AJAX handler and high-severity taint flows represent immediate risks. The historical pattern of authorization and CSRF issues further reinforces the need for scrutiny in these areas. Users should be aware of these specific weaknesses.