Guten Free Options Security & Risk Analysis

The 'guten-free-options' plugin version 0.9.7 exhibits a concerning security posture despite some positive indicators. While the plugin demonstrates excellent practices in output escaping, with 100% of outputs properly escaped, and makes good use of prepared statements for SQL queries (89%), it suffers from a significant vulnerability in its handling of entry points.

The static analysis reveals a total of 4 AJAX handlers, alarmingly, all 4 lack authentication checks. This presents a substantial attack surface without any protective measures. Furthermore, the taint analysis highlights a high severity flow with unsanitized input, indicating a potential risk of data manipulation or unauthorized actions. The presence of 5 unsanitized paths in the taint analysis, even without a critical severity finding, warrants attention.

The plugin's vulnerability history is a major red flag. It has two known medium severity CVEs, both of which are currently unpatched. The common vulnerability type being Cross-site Scripting, coupled with the fact that the last vulnerability was very recent (2025-01-17), strongly suggests recurring issues with input sanitization or improper neutralization of data. This pattern of unpatched vulnerabilities indicates a lack of proactive security maintenance and a potential ongoing risk to user data and site integrity.