Jomres Hotel Booking Engine for WordPress Security & Risk Analysis

The Jomres plugin v10.7.2 presents a mixed security posture. On the positive side, there are no known vulnerabilities (CVEs) or reported taint flows, suggesting a generally clean codebase. The absence of dangerous functions and bundled libraries is also a good sign. However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers without any authentication checks, creating a direct attack vector for unauthorized actions. Furthermore, none of the identified entry points have nonce checks, which is a critical omission for preventing CSRF attacks. The plugin also uses SQL queries without prepared statements, increasing the risk of SQL injection vulnerabilities, especially when combined with unescaped output, as only 50% of outputs are properly escaped. The lack of capability checks on AJAX handlers is another glaring security gap. While the vulnerability history is clean, the static analysis reveals several potential weaknesses that could be exploited if not addressed.