GoToViaR Security & Risk Analysis

The "gotoviar" v1.2.2 plugin exhibits a concerning security posture due to a significant lack of authorization checks on its exposed entry points. While the static analysis shows no dangerous functions, raw SQL queries, or file operations, the presence of 3 unprotected REST API routes represents a substantial risk. These routes are directly accessible and can potentially be exploited by unauthenticated users, leading to various vulnerabilities depending on their implementation. The absence of nonce and capability checks further exacerbates this risk by allowing any user to trigger these functions.

The plugin also demonstrates a critical weakness in output escaping, with 0% of its 8 output points being properly escaped. This means that sensitive data, if processed by these routes, could be susceptible to cross-site scripting (XSS) attacks. Despite the absence of recorded CVEs and taint analysis indicating no apparent issues, the identified weaknesses in authorization and output sanitization are severe enough to warrant significant caution. The plugin's vulnerability history is clean, which is a positive sign, but this does not negate the current, demonstrable risks present in the code.