LAT Affiliate Tool Security & Risk Analysis

The "lat-affiliate-tool" plugin v1.2.3 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and avoiding dangerous functions, file operations, and external HTTP requests. The plugin also includes nonce checks, which is a fundamental security measure. However, there are significant concerns regarding its attack surface. The presence of two AJAX handlers without authentication checks creates an exploitable path for attackers. Additionally, while taint analysis found only one flow, the fact that it involved unsanitized paths is a red flag, even if it didn't reach critical or high severity in this analysis.