Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin Security & Risk Analysis

The 'majestic-support' plugin version 1.1.2 presents a concerning security posture. While it demonstrates good practices in output escaping and a high rate of prepared SQL statements, significant weaknesses are present. The static analysis reveals a total of 6 entry points, with 2 of them lacking proper authentication checks. Furthermore, the presence of the `unserialize` function, a known vector for serious vulnerabilities, is a critical concern. The taint analysis identified 7 high-severity flows with unsanitized paths, indicating potential for data manipulation or code execution if not handled with extreme care.

The plugin's vulnerability history is particularly alarming, with a total of 7 known CVEs, including 1 critical and 3 high-severity issues. The fact that 1 CVE remains unpatched is a direct and immediate threat. The common vulnerability types listed, such as Missing Authorization, SQL Injection, PHP Remote File Inclusion, and Authorization Bypass, strongly suggest recurring and fundamental security flaws in the plugin's design and implementation. The recurrence of these types of vulnerabilities indicates a systemic issue that needs to be addressed comprehensively.

In conclusion, despite some positive code signals, the 'majestic-support' plugin has significant security deficiencies. The combination of unprotected entry points, dangerous function usage, high-severity taint flows, and a history of critical and unpatched vulnerabilities makes this plugin a high-risk component for any WordPress installation. Organizations should exercise extreme caution and consider disabling or replacing this plugin until all identified security issues are resolved and verified.