Karrya Field service management system Security & Risk Analysis

The "karrya-field-service-management-system" plugin v1.6.2 presents a mixed security posture. While it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output, along with a significant number of nonce and capability checks, there are significant concerns regarding its attack surface. A large number of AJAX handlers (14 out of 16) lack authentication checks, creating numerous potential entry points for attackers. This is further exacerbated by the taint analysis revealing a concerning number of flows with unsanitized paths, all of which are categorized as high severity. The plugin's history of zero known CVEs is a positive indicator, suggesting a potentially well-maintained codebase. However, the high severity taint flows, despite the lack of historical vulnerabilities, represent a clear and present risk that should not be overlooked.