Multisite Admin Bar Switcher Security & Risk Analysis

The 'multisite-admin-bar-switcher' v1.4.0 plugin presents a concerning security posture due to a single, unprotected AJAX handler, which represents its entire attack surface. While static analysis did not reveal critical vulnerabilities such as dangerous functions, unsanitized taint flows, or SQL injection risks, the absence of authentication checks on this entry point is a significant weakness. This could allow unauthenticated users to potentially trigger functionality within the plugin, leading to unintended consequences or information disclosure, depending on what the AJAX handler performs.

The plugin's code signals show that the single SQL query is not using prepared statements, which is a potential risk for SQL injection if the query's parameters are not properly sanitized. The relatively low percentage of properly escaped output also raises a flag, as it might expose the site to Cross-Site Scripting (XSS) vulnerabilities. The plugin's history of zero recorded CVEs is positive, indicating a generally stable security record. However, this does not mitigate the immediate risks identified in the static analysis, particularly the unprotected AJAX handler and the un-prepared SQL query.