Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking Security & Risk Analysis

The "mail-control" plugin v0.3.9 exhibits a concerning security posture primarily due to its unprotected AJAX handlers. The static analysis reveals a significant attack surface with 6 AJAX handlers, all of which lack authentication checks. This presents a high risk of unauthorized actions being performed by unauthenticated users. While the plugin demonstrates good practices in its use of prepared statements for SQL queries (85%) and proper output escaping (87%), and no critical or high severity taint flows were detected, the unprotected entry points are a major weakness. The vulnerability history indicates one past high-severity CVE related to Cross-site Scripting, which, combined with the current lack of authentication on AJAX handlers, suggests a potential for similar vulnerabilities to be exploited if not addressed. The plugin has strengths in its SQL and output handling but critically fails to secure its primary interaction points.