Mail Manager for WPForms ( wpforms entries ) – Database for wpforms Security & Risk Analysis

The mail-manager-wpforms plugin v1.1.2 exhibits a mixed security posture. On the positive side, it demonstrates excellent practices regarding SQL queries, using prepared statements exclusively, and all output appears to be properly escaped, significantly reducing the risk of common injection and XSS vulnerabilities. Furthermore, the absence of known CVEs and a clean vulnerability history suggests a generally well-maintained codebase. However, significant concerns arise from the attack surface. Two AJAX handlers lack authentication checks, and while there are no REST API routes without permission callbacks, the presence of unprotected AJAX endpoints presents a clear risk. The taint analysis reveals five high-severity flows with unsanitized paths, which, despite not being classified as 'critical', warrant immediate attention as they could potentially be exploited if user-supplied data is not adequately validated before being processed in these flows. The plugin's strengths lie in its robust data handling and lack of historical vulnerabilities, but the unprotected entry points and high-severity taint flows are considerable weaknesses that could be exploited.