Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Security & Risk Analysis

The plugin 'gutena-forms' v1.6.1 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and output escaping, which are strong indicators of secure coding, there are significant concerns related to its attack surface and taint analysis. The presence of two AJAX handlers without authentication checks is a primary vulnerability, potentially allowing unauthorized users to trigger sensitive actions. This is further compounded by taint analysis revealing four flows with unsanitized paths, all classified as high severity, indicating a substantial risk of data manipulation or injection vulnerabilities if these paths are reachable through the unprotected AJAX endpoints. The plugin's vulnerability history, with a single medium CVE last recorded in 2026, suggests a past security issue that has since been addressed, but the recent nature of that vulnerability and the current high-severity taint flows warrant careful attention. Overall, while the developer seems to be making efforts towards secure coding, the current version has exploitable weaknesses that need immediate remediation.