Transients Security & Risk Analysis

The "leira-transients" v1.0.5 plugin exhibits a mixed security posture. On the positive side, it demonstrates excellent practices regarding SQL queries, using prepared statements exclusively, and has a very high rate of properly escaped output. Furthermore, the absence of any recorded vulnerabilities or CVEs in its history suggests a history of relatively secure development. However, the plugin has significant security concerns related to its attack surface. It exposes two AJAX handlers, both of which lack authentication checks. This directly translates to two critical taint flows with unsanitized paths, indicating a high risk of unauthorized actions or data manipulation through these unprotected entry points. While the presence of nonce checks and capability checks on some code paths is encouraging, the two unprotected AJAX handlers represent a substantial security weakness that needs immediate attention.