LIBRO DE VISITAS – GUESTBOOK Security & Risk Analysis

The 'libro-de-visitas-guestbook' plugin v1.4 presents a mixed security posture. While it demonstrates good practices by not utilizing dangerous functions, performing all SQL queries with prepared statements, and avoiding external HTTP requests or file operations, significant security concerns arise from its handling of entry points. All four identified AJAX handlers lack authentication checks, creating a wide attack surface for potential unauthorized actions. The taint analysis further highlights this, with two flows identified as having unsanitized paths and classified as high severity, indicating a risk of data being manipulated or exploited through these entry points. Despite a clean vulnerability history with no recorded CVEs, this absence might be due to the plugin not being widely targeted or the vulnerabilities being recent. The lack of nonces and capability checks on the AJAX handlers, combined with the identified unsanitized paths, are the most pressing issues. A strong recommendation for immediate review and patching of these unprotected AJAX handlers is warranted.