Contact Form By Mega Forms – Drag and Drop Form Builder Security & Risk Analysis

The plugin 'mega-forms' v1.6.9 presents a mixed security posture. While it demonstrates good practices in SQL query preparation (74%) and output escaping (64%), significant concerns arise from its attack surface. All 5 identified AJAX handlers lack proper authentication checks, making them prime targets for unauthorized actions. The taint analysis, while not revealing critical or high severity issues, did identify 6 flows with unsanitized paths, indicating a potential for vulnerabilities if malicious data is introduced. The vulnerability history shows a past pattern of Missing Authorization and Cross-site Scripting vulnerabilities, reinforcing the risk associated with the unprotected AJAX endpoints. Although there are no currently unpatched CVEs, the historical trend and the static analysis findings suggest a need for immediate attention to the lack of authorization checks on AJAX handlers to mitigate potential security risks.