Humans TXT Security & Risk Analysis

The humansTXT plugin v1.3.1 exhibits a mixed security posture. While it has no recorded vulnerabilities (CVEs) and a lack of dangerous file operations or external HTTP requests are positive signs, several areas warrant concern. The presence of an unprotected AJAX handler represents a significant attack vector, as it lacks authentication checks, making it potentially exploitable by unauthenticated users. Furthermore, the plugin utilizes raw SQL queries without prepared statements, which can lead to SQL injection vulnerabilities if user input is not properly sanitized. The taint analysis reveals that all four analyzed flows have unsanitized paths, though thankfully none are classified as critical or high severity. However, this indicates a potential for data to be mishandled. The limited number of entry points is a positive, but the unprotected AJAX handler significantly increases the risk profile. Overall, the plugin has some good security practices but suffers from critical vulnerabilities in authentication and SQL handling.