Moloni Security & Risk Analysis

The Moloni plugin v5.0.04 exhibits a mixed security posture. On the positive side, the code demonstrates good practices in output escaping, with 93% of outputs being properly escaped. Furthermore, the majority of SQL queries are handled using prepared statements, which is a significant strength in preventing SQL injection vulnerabilities. The absence of critical or high-severity taint analysis findings and the fact that all previously known vulnerabilities are patched are also positive indicators.

However, there are significant security concerns. The plugin has a substantial attack surface with 6 AJAX handlers, all of which are unprotected and lack authentication checks. This is a critical oversight that could allow unauthenticated users to trigger arbitrary actions within the plugin. The complete absence of nonce checks on AJAX handlers exacerbates this risk. While the vulnerability history shows only one medium-severity CVE, and it's patched, the presence of an XSS vulnerability in the past, combined with the current lack of AJAX authentication, suggests a potential for similar vulnerabilities to be introduced or exploited if input is not properly validated and escaped on these unprotected AJAX endpoints.

In conclusion, while the Moloni plugin has strengths in its SQL query handling and output escaping, the unprotected AJAX endpoints represent a critical security weakness. The lack of authentication and nonce checks on these entry points creates a high risk of unauthorized access and potential exploitation. Addressing these unprotected AJAX handlers should be the highest priority.