Gravity Forms Data Persistence Add-On Reloaded Security & Risk Analysis

The plugin "gravity-forms-data-persistence-add-on-reloaded" v3.3.1 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by avoiding dangerous functions, performing all SQL queries using prepared statements, and having no recorded vulnerabilities. This suggests a developer who is mindful of common web application security pitfalls.

However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers, and critically, neither of them includes authentication checks. This creates a substantial attack surface where unauthenticated users could potentially trigger these handlers, leading to unintended actions or information disclosure. Furthermore, only 50% of its output is properly escaped, which could open the door to cross-site scripting (XSS) vulnerabilities if user-controlled data is involved in the unescaped outputs.

The absence of any recorded vulnerabilities, while a positive sign, might also be attributed to the lack of known exploits targeting these specific weaknesses or the plugin's limited adoption. The lack of taint analysis flows is also noteworthy, meaning the analysis couldn't identify any data flow issues, which is good, but it's limited by the analysis itself. Overall, while the plugin avoids some common pitfalls, the unprotected AJAX endpoints and potential for XSS due to incomplete output escaping represent real security risks that require immediate attention.