Gwolle Guestbook Security & Risk Analysis

The "gwolle-gb" plugin exhibits a mixed security posture. While it demonstrates good practices such as a significant number of nonce and capability checks, and a reasonable percentage of SQL queries using prepared statements, several concerning areas are present. The static analysis reveals a substantial attack surface, particularly with 6 out of 7 AJAX handlers lacking authentication checks. Although no critical or high severity taint flows were identified, the presence of 2 flows with unsanitized paths warrants attention as they could potentially lead to vulnerabilities if not handled carefully. The plugin's history of 7 known CVEs, including past critical and high severity issues like Cross-Site Scripting, CSRF, and PHP Remote File Inclusion, is a significant concern. The fact that there are currently no unpatched vulnerabilities is positive, but the historical pattern suggests a recurring tendency for vulnerabilities to be introduced or discovered. The plugin's last reported vulnerability was in July 2025, which is concerning as it implies recent issues or a delayed reporting mechanism.