Long Toolkit Security & Risk Analysis

The long-toolkit v2.5 plugin exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL query handling, exclusively using prepared statements, which significantly mitigates SQL injection risks. Furthermore, the absence of recorded CVEs and the clean taint analysis results indicate a low likelihood of known or easily exploitable vulnerabilities within the current version. However, a significant concern arises from the attack surface. The plugin exposes five AJAX handlers, and alarmingly, all of them lack authentication checks. This creates a substantial entry point for potential attackers to interact with the plugin's functionality without proper authorization, which could lead to unintended actions or data manipulation. While the plugin doesn't appear to have a history of vulnerabilities, the current implementation of unprotected AJAX endpoints presents an immediate and actionable security risk that warrants attention.