Modular Finance Calculators by M92 Security & Risk Analysis

The 'gettech-finance-calculators' plugin v1.1.7 exhibits a strong security posture based on the provided static analysis. The absence of dangerous functions, SQL injection vulnerabilities (all queries use prepared statements), and improperly escaped output are significant strengths. The plugin also avoids file operations and external HTTP requests, further reducing its attack surface. The lack of any recorded CVEs in its vulnerability history also suggests a history of secure development or a lack of prior exploitation.

However, there are some notable areas for concern. The presence of two shortcodes as entry points, coupled with zero capability checks, indicates a potential weakness. If these shortcodes handle user-provided input without proper authorization checks, they could be susceptible to privilege escalation or unauthorized data manipulation. The zero nonce checks on its entry points is another significant omission, especially in conjunction with shortcodes, as it leaves these functionalities open to Cross-Site Request Forgery (CSRF) attacks. While the taint analysis showed no critical or high-severity issues, this might be due to the limited scope of the analysis or the fact that the shortcodes, which are the primary entry points, were not analyzed for taint flows. The overall security is good, but the lack of authorization and nonce checks on shortcodes presents a tangible risk.