MailHawk — Simple SMTP, Email Delivery, and Email Logging Security & Risk Analysis

The MailHawk plugin v1.3.5 exhibits a mixed security posture. While it demonstrates good practices in areas like prepared SQL statements and output escaping, there are significant concerns regarding its attack surface and past vulnerabilities. The presence of two AJAX handlers, one of which lacks authentication checks, and a REST API route without permission callbacks, creates direct entry points for potential attackers. The static analysis also flagged the use of the `unserialize` function, a known source of vulnerabilities if not handled with extreme care, though no specific exploit flows were identified in the taint analysis. The vulnerability history is a major red flag, indicating a past critical vulnerability related to Remote File Inclusion. Although this CVE is currently unpatched, the fact that it's in the past and not marked as currently unpatched is a slight positive, but the pattern of past critical flaws warrants caution. Overall, the plugin has some solid security implementations but is undermined by unprotected entry points and a history of critical security issues.