WP Marketing Security & Risk Analysis

The intellasphere v1.1.7 plugin exhibits a mixed security posture. While it demonstrates good practices in output escaping (92% properly escaped) and largely uses prepared statements for SQL queries (78%), several significant concerns exist. The most alarming finding is the large number of unprotected entry points, with 14 out of 14 AJAX handlers and 1 out of 1 REST API routes lacking authentication or capability checks. This creates a substantial attack surface accessible to unauthenticated users.

Taint analysis reveals 6 total flows, with all 6 having unsanitized paths and 2 identified as high severity. This, combined with the lack of authentication on many entry points, suggests a high risk of injection vulnerabilities or data manipulation. The absence of any recorded vulnerability history is a positive sign, indicating a potentially stable codebase, but it does not negate the immediate risks identified in the static and taint analyses. The plugin has strengths in its output escaping and SQL query handling, but the critical lack of access control on numerous entry points and high-severity taint flows represent significant weaknesses that must be addressed.