Mandatly | Cookie Compliance and Consent solution Security & Risk Analysis

The "mandatly-cookie-compliance-and-consent-solution" v1.3.0 plugin exhibits a significant security concern due to its extensive unprotected attack surface. All 11 identified AJAX handlers lack authentication checks, presenting a wide entry point for malicious actors to potentially interact with sensitive functionalities. While the plugin demonstrates good practices in SQL query handling, with 100% using prepared statements, and generally good output escaping (99%), the absence of nonce and capability checks on these AJAX endpoints is a major weakness. The taint analysis did not reveal critical or high-severity issues, and the plugin has no recorded vulnerability history, which are positive indicators. However, the lack of any security checks on a substantial portion of its attack surface outweighs these strengths, making it a risky choice without further hardening.