LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart Security & Risk Analysis

The lazytasks-project-task-management plugin exhibits a significant security risk due to multiple unprotected entry points, particularly its AJAX handlers and REST API routes which lack proper authorization checks. While the plugin demonstrates strong practices in SQL query preparation and output escaping, the presence of unprotected AJAX endpoints and a REST API route significantly broadens its attack surface, making it vulnerable to unauthorized actions. The plugin's vulnerability history is a major concern, with two known critical CVEs, both currently unpatched. These historical vulnerabilities, specifically Incorrect Privilege Assignment and Missing Authorization, directly correlate with the observed lack of authorization checks in the static analysis. This pattern suggests a recurring weakness in how the plugin handles user permissions and access control. While the plugin's adherence to prepared statements and output escaping is commendable, the critical unpatched vulnerabilities and unprotected entry points create a high-risk environment. Prompt patching of existing vulnerabilities and immediate implementation of authorization checks on all entry points are strongly recommended.