Max Access – DEPRECATED (new plugin available) Security & Risk Analysis

The "max-access" v2.0.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, using prepared statements for all SQL queries, and having no recorded vulnerabilities. However, the plugin has a significant security concern due to its attack surface. It exposes one AJAX handler without any authentication or capability checks, making it a prime target for unauthorized actions. This lack of protection on a critical entry point is a major weakness.

The taint analysis revealed one flow with an unsanitized path, which is a serious concern even without a critical or high severity rating. This suggests that user-supplied data might be processed in an unsafe manner, potentially leading to vulnerabilities if exploited. The absence of nonce checks on the unprotected AJAX handler further exacerbates this risk, as it facilitates Cross-Site Request Forgery (CSRF) attacks.

While the plugin's vulnerability history is clean, indicating good development practices historically, the current static analysis results highlight immediate and actionable security risks. The combination of an unprotected AJAX endpoint, an unsanitized path flow, and a lack of nonce checks creates a substantial security gap that needs to be addressed to improve the plugin's overall security.