MaxiCharts Query Builder Add-on Security & Risk Analysis

The 'maxicharts-query-builder-add-on' v1.2.2 plugin exhibits a concerning security posture due to its significant number of unprotected AJAX handlers. While the plugin demonstrates good practices by not using dangerous functions, performing 100% of SQL queries with prepared statements, and having no recorded vulnerability history, the lack of authentication on its entry points presents a substantial risk. The static analysis reveals that all four identified AJAX handlers lack authorization checks, making them direct targets for attackers. Although taint analysis found no critical or high severity issues and output escaping is moderately well-handled, the absence of capability checks and nonce checks on these handlers leaves them vulnerable to unauthorized data manipulation or execution. The vulnerability history being clean is a positive sign, suggesting a generally secure development process, but it doesn't negate the immediate risks posed by the exposed AJAX endpoints. The plugin's strengths lie in its SQL hygiene and lack of past vulnerabilities, but the weakness in securing its primary interaction points is a critical concern.