iZooto – Web Push Notifications Security & Risk Analysis

The izooto-web-push plugin v3.7.20 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and a high percentage of properly escaped output, there are significant concerns regarding its attack surface and lack of authentication checks.

The static analysis reveals one AJAX handler that lacks any authentication checks, presenting a direct entry point for potential malicious activity. Although taint analysis did not uncover critical or high severity vulnerabilities, the two identified flows with unsanitized paths are concerning and warrant further investigation, especially in conjunction with the unprotected AJAX handler. The absence of capability checks and the presence of external HTTP requests also add to the potential attack vectors.

The plugin's vulnerability history is remarkably clean, with no known CVEs. This lack of past issues is a positive indicator, suggesting either a strong development focus on security or limited exposure to sophisticated attacks. However, the presence of unprotected entry points in the current version means that this clean history could be a temporary state. Overall, the plugin has strengths in its handling of SQL and output, but the unprotected AJAX handler and unsanitized paths represent tangible risks that need to be addressed.