Market Exporter Security & Risk Analysis

The market-exporter plugin, version 2.0.23, presents a mixed security posture. While it demonstrates good practices in output escaping and the absence of dangerous functions or external HTTP requests, significant concerns remain regarding its attack surface and historical vulnerability patterns. The static analysis revealed three AJAX handlers lacking authentication checks, representing a direct and potentially exploitable entry point for attackers. Furthermore, the plugin's entire SQL query is executed without prepared statements, posing a risk of SQL injection if any user-controlled data is involved in constructing that query. The vulnerability history indicates a recurring pattern of Cross-Site Request Forgery (CSRF) and Missing Authorization vulnerabilities, suggesting systemic issues in how user actions and permissions are handled. Although there are no currently unpatched CVEs, the prevalence of past vulnerabilities, particularly high and medium severity ones, warrants caution. Overall, while the plugin has some strengths, the identified unauthenticated entry points and the history of authorization-related vulnerabilities create a considerable security risk.