myCred GiveWP Security & Risk Analysis

The plugin "mycred-givewp" v1.0.8 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries and has no known historical vulnerabilities. This suggests a generally well-maintained codebase and a commitment to security from the developers. The absence of file operations and external HTTP requests also limits potential attack vectors.

However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers, both of which lack authentication checks. This creates a direct and unprotected attack surface, allowing any visitor to trigger these functions. Furthermore, the analysis indicates a lack of nonce and capability checks for these entry points, making them susceptible to Cross-Site Request Forgery (CSRF) and unauthorized actions. While no critical or high severity taint flows were detected, and output escaping is at a moderate 62%, the unprotected AJAX endpoints are the most pressing security issue.

In conclusion, the plugin's lack of historical vulnerabilities and use of prepared statements are strengths. However, the presence of unprotected AJAX endpoints represents a critical weakness that could be exploited. The absence of nonce and capability checks exacerbates this risk. Addressing these unprotected entry points should be the immediate priority to improve the plugin's security.