Mailing Manager – PN Security & Risk Analysis

The "mailpn" plugin v1.0.20 exhibits a concerning security posture due to a significant number of unprotected entry points. The static analysis reveals 3 total entry points, with all 3 lacking proper authentication or permission checks. This includes 2 AJAX handlers and 1 REST API route that are directly accessible to unauthenticated users, posing a significant risk of unauthorized actions. While the code demonstrates good practices in other areas, such as the absence of dangerous functions, the exclusive use of prepared statements for SQL queries, and a high percentage of properly escaped output, these strengths are overshadowed by the critical flaw of unprotected endpoints. The plugin's vulnerability history is clean, with no recorded CVEs, which is a positive sign. However, the current static analysis findings suggest that even without past vulnerabilities, the inherent design of the accessible entry points creates a high potential for future exploits. The plugin needs immediate attention to implement robust authentication and authorization mechanisms for all identified entry points to mitigate the substantial risks.