Kento Ajax Contact Form Security & Risk Analysis

The "kento-ajax-contact-form" plugin version 1.0 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries, properly escaping all output, and not performing file operations or external HTTP requests. There are also no recorded vulnerabilities in its history, suggesting a potentially stable and well-maintained codebase in the past. However, significant concerns arise from the attack surface. The plugin exposes two AJAX handlers without any authentication or capability checks, creating direct entry points for unauthenticated users. This lack of protection for critical functionalities is a notable weakness. Furthermore, the absence of nonce checks on these AJAX handlers compounds the risk, making them susceptible to Cross-Site Request Forgery (CSRF) attacks. While taint analysis and vulnerability history are clean, the active, unprotected AJAX endpoints represent a tangible and immediate security risk that should be addressed.