iConvert Promoter Security & Risk Analysis

The iconvert-promoter plugin v1.0.2 presents a mixed security posture. On the positive side, the plugin exhibits strong practices in SQL query execution and output escaping, with a very high percentage of SQL queries using prepared statements and a vast majority of outputs being properly escaped. The absence of recorded vulnerabilities and CVEs is also a significant strength, suggesting a generally well-maintained codebase in terms of known security flaws.

However, the plugin has notable security concerns stemming from its static analysis. The large number of unprotected AJAX handlers (26 out of 27) represents a substantial attack surface, making it vulnerable to unauthorized actions if these handlers can be triggered by unauthenticated users. The presence of the `unserialize` function, a known source of potential vulnerabilities if used with untrusted input, coupled with three critical taint flows with unsanitized paths, indicates a direct risk of code injection or other severe exploits. While no CVEs are recorded, these inherent risks in the code demand attention.

In conclusion, while iconvert-promoter benefits from good SQL and output sanitization practices and a clean vulnerability history, the significant number of unprotected AJAX endpoints and the critical taint flows with unsanitized paths introduce substantial security risks that outweigh its strengths. The potential for unauthorized access and code execution through these vectors requires immediate remediation to improve its overall security posture.