Pricing Tables Free Security & Risk Analysis

The "kento-pricing-table-free" v2.4 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and has a clean vulnerability history with no known CVEs. The absence of dangerous functions, file operations, and external HTTP requests is also commendable. However, significant concerns arise from the attack surface. Two AJAX handlers lack authentication checks, presenting a clear entry point for unauthorized actions. While the taint analysis did not reveal critical or high severity issues, the presence of one flow with an unsanitized path, even if deemed lower severity, warrants attention, especially when coupled with the unescaped output percentage. The plugin also has a limited number of nonce checks relative to its entry points. Overall, while the plugin avoids common pitfalls like raw SQL and known exploits, the unprotected AJAX handlers and the high percentage of unescaped output are notable weaknesses that could be exploited.