Map2App Connector Security & Risk Analysis

The map2app-connector plugin version 1.0 exhibits significant security concerns due to its handling of entry points. While the plugin boasts no known CVEs and a low number of total SQL queries with a high percentage using prepared statements, these positives are heavily overshadowed by critical weaknesses. The presence of two AJAX handlers with no authentication checks creates a substantial attack surface, making it vulnerable to unauthorized actions. Furthermore, the complete lack of output escaping is a severe oversight, exposing users to potential cross-site scripting (XSS) vulnerabilities. The absence of nonce checks and capability checks on these AJAX endpoints exacerbates the risk, as it allows any authenticated user, regardless of their role, to potentially trigger these actions. The lack of any recorded vulnerability history is not necessarily an indicator of robust security but could simply mean it hasn't been thoroughly audited or targeted yet. Overall, the plugin's security posture is poor, with critical flaws in input validation and output handling that demand immediate attention.