tags.mowster Security & Risk Analysis

The mowster-tags plugin v1.71 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and properly escaping a high percentage of its output. The absence of known vulnerabilities in its history is also a strong indicator of a generally well-maintained plugin.

However, there are significant concerns regarding its attack surface and handling of potentially dangerous operations. The presence of an unprotected AJAX handler is a critical vulnerability, as it represents a direct entry point for attackers without any authentication or authorization checks. Additionally, the use of the `unserialize` function is a known security risk, as it can lead to Remote Code Execution (RCE) if not handled with extreme care and input validation. While taint analysis did not reveal critical or high-severity issues, the existence of flows with unsanitized paths, even if not explicitly critical, warrants caution. The lack of nonce checks on the AJAX handler amplifies the risk associated with that entry point.

In conclusion, while the plugin's history and SQL practices are commendable, the unprotected AJAX handler and the use of `unserialize` represent substantial security weaknesses. These are critical areas that need immediate attention to mitigate potential exploitation.