PickPlugins Mail Picker — Email Marketing & Newsletters Security & Risk Analysis

The 'mail-picker' plugin v1.0.17 presents a mixed security posture. On the positive side, it demonstrates good practices with 100% of its SQL queries utilizing prepared statements and a high percentage (92%) of output escaping. The absence of bundled outdated libraries and a complete lack of currently unpatched CVEs are also encouraging signs. However, significant concerns arise from the substantial attack surface exposed without proper authentication checks. Six out of ten entry points, including all five REST API routes and one AJAX handler, lack permission callbacks, leaving them vulnerable to unauthorized access and potential exploitation. The presence of the `unserialize` function, coupled with seven critical taint flows without sanitization, strongly suggests a high risk of deserialization vulnerabilities, particularly when combined with the unprotected entry points. The plugin's history of two critical and medium CVEs, specifically related to deserialization and XSS, reinforces these concerns, indicating a recurring pattern of vulnerabilities that attackers could potentially leverage if a new zero-day emerges or if older, but unpatched, vulnerabilities are still exploitable in specific configurations.