IATI Project Data Security & Risk Analysis

The iati-project-data plugin v1.0 exhibits a generally good security posture with no known vulnerabilities in its history and a low attack surface. The code analysis indicates good practices in terms of output escaping and the absence of dangerous functions or file operations. The lack of critical or high-severity taint flows is also a positive sign. However, there are significant areas of concern that prevent a "good" rating. The plugin makes 10 SQL queries, none of which utilize prepared statements, presenting a substantial risk of SQL injection. Additionally, there are no capability checks on any entry points, meaning any user, regardless of their role, could potentially trigger plugin functionalities. While there is a nonce check, its presence alone doesn't mitigate the risk of raw SQL queries or the complete lack of authorization checks.