myCred – GamiPress Importer Security & Risk Analysis

The 'mycred-gamipress-importer' plugin version 1.1.8 presents a moderate security risk due to critical vulnerabilities in its handling of entry points. The static analysis reveals a significant concern with two AJAX handlers that lack any authentication checks. This means that any user, even unauthenticated ones, could potentially trigger these handlers, leading to unauthorized actions or information disclosure. The absence of nonce checks further exacerbates this risk, as it opens the door to Cross-Site Request Forgery (CSRF) attacks.

While the plugin demonstrates good practices in other areas, such as using prepared statements for most SQL queries and a lack of dangerous functions or file operations, the unprotected entry points are a major weakness. The fact that there are no recorded vulnerabilities in its history is a positive indicator of past security efforts, but it doesn't mitigate the immediate risks identified in the current code. The low percentage of properly escaped output is also a concern, potentially leading to Cross-Site Scripting (XSS) vulnerabilities.

Overall, the plugin's security posture is concerning primarily because of the unprotected AJAX endpoints. Despite a clean vulnerability history, the identified code signals necessitate caution. Users should be aware of the potential for unauthorized access and data manipulation. Further security hardening, particularly implementing proper authentication and authorization checks on all AJAX handlers, is strongly recommended.