My Post Order Security & Risk Analysis

The "my-posts-order" plugin version 1.2.1.1 exhibits a concerning security posture due to a significant number of unprotected AJAX handlers and a history of vulnerabilities. While the plugin demonstrates some good practices like the use of prepared statements for the majority of its SQL queries and a non-existent external HTTP request surface, these strengths are overshadowed by critical weaknesses. The presence of 7 AJAX handlers with no authentication checks presents a wide attack surface, making it vulnerable to unauthorized actions. Furthermore, the taint analysis indicating flows with unsanitized paths, though not reaching critical or high severity, suggests potential injection risks that could be exploited.

The vulnerability history of this plugin is a major red flag. With one known medium-severity CVE that remains unpatched, and a recent vulnerability dated in the future (2026-01-19), it indicates a pattern of security flaws. The common vulnerability type being Cross-site Scripting further highlights the risks associated with improper input neutralization. The plugin's overall lack of capability checks and a single nonce check on entry points further exacerbates these risks, as it relies heavily on front-end validation or insufficient back-end security.

In conclusion, despite some positive aspects like structured SQL queries, the "my-posts-order" plugin version 1.2.1.1 has significant security deficiencies. The unprotected AJAX endpoints, the presence of unsanitized data flows, and the unpatched vulnerability create substantial risks. Users should be extremely cautious, and developers should prioritize addressing the numerous security concerns, particularly the unprotected entry points and the unpatched CVE.