Listdomer Core – Core of Listdomer Theme Security & Risk Analysis

The 'listdomer-core' plugin v4.1.0 presents a concerning security posture primarily due to its unprotected entry points. With two AJAX handlers identified and neither possessing authentication checks, there's a significant risk of unauthorized actions being performed. The absence of any capability checks further exacerbates this, meaning any authenticated user, regardless of their role, could potentially trigger these handlers. While the static analysis shows a reasonable rate of output escaping and no critical or high-severity taint flows, the lack of input validation on the unprotected AJAX endpoints is a major red flag. The plugin's vulnerability history is clean, with no recorded CVEs. This could indicate either a well-developed plugin or simply a lack of past security scrutiny. However, the current code analysis reveals clear weaknesses that could be exploited, making the clean history less reassuring. The plugin's strengths lie in its minimal use of dangerous functions and lack of bundled libraries. Nevertheless, the two unprotected AJAX handlers without any form of authorization or capability checks represent a critical security vulnerability that needs immediate attention.