Visitor Analytics and Lead Generation Plugin by Inbound Rocket Security & Risk Analysis

The inbound-rocket plugin version 2.0.0 exhibits a mixed security posture. While it demonstrates good practices in several areas, such as a high percentage of SQL queries using prepared statements and properly escaped output, there are significant concerns regarding its attack surface and potential for vulnerabilities. The presence of 16 AJAX handlers without authentication checks is a critical weakness, creating readily exploitable entry points for attackers. Additionally, the taint analysis revealed 3 flows with unsanitized paths, which, although not classified as critical or high severity in the provided data, represent potential pathways for exploiting user-supplied data if not handled carefully. The plugin's vulnerability history is clean, with no recorded CVEs, which is a positive sign. However, this absence of historical issues should not overshadow the inherent risks identified in the static analysis. The combination of unprotected entry points and unsanitized data flows warrants careful consideration and mitigation.