Gym Builder – Fitness, Gym, Class Schedule Maker Plugin Security & Risk Analysis

The 'gym-builder' plugin v2.3.1 exhibits a generally good security posture, with a high percentage of SQL queries using prepared statements and proper output escaping. The plugin also demonstrates a strong adherence to nonces and capability checks, indicating an awareness of common WordPress security best practices. Its lack of any recorded vulnerabilities or CVEs further bolsters confidence in its current security state.

However, the analysis reveals several areas of concern. A significant portion of the attack surface, specifically 6 out of 14 AJAX handlers and 1 out of 4 REST API routes, lacks proper authentication or permission checks. This presents a considerable risk, as unauthenticated or unauthorized users could potentially trigger these endpoints, leading to unintended actions or information disclosure. Additionally, the presence of the `unserialize` function, even if not immediately flagged by taint analysis in this specific version, is a known dangerous function that can lead to deserialization vulnerabilities if not handled with extreme care and proper input validation.

In conclusion, while the plugin benefits from a clean vulnerability history and strong implementation of core security features like prepared statements and output escaping, the unprotected entry points in its AJAX handlers and REST API are a notable weakness. The presence of `unserialize` also warrants caution. Developers should prioritize addressing the unprotected AJAX and REST API endpoints to mitigate potential risks.