GateLink Manager – Secure One‑Click Admin Login & WordPress SSO Security & Risk Analysis

The gatelink-manager plugin version 1.8.3 exhibits a concerning security posture primarily due to its significant number of unprotected AJAX handlers. While the code shows good practices in SQL query handling and output escaping, the presence of 15 AJAX endpoints without authentication checks presents a substantial attack surface. Taint analysis, although limited in scope (9 flows analyzed), did reveal 5 flows with unsanitized paths, indicating potential areas where malicious input could be processed without proper validation, though no critical or high severity issues were flagged in this analysis. The plugin's vulnerability history is clean, with no recorded CVEs, which suggests a potentially stable development but doesn't negate the risks identified in the static analysis. The overall picture is one of a plugin that adheres to some security best practices but suffers from a critical oversight in securing its AJAX endpoints, which could be exploited if those endpoints are susceptible to privilege escalation or data manipulation.