myCred Tutor LMS – Gamification in eLearning Security & Risk Analysis

The "mycred-tutor-lms-gamification-in-elearning" plugin v1.0.8 exhibits several concerning security weaknesses despite a lack of recorded historical vulnerabilities. A significant concern is the presence of four AJAX handlers that entirely lack authentication checks, creating a substantial attack surface for unauthorized actions. Furthermore, the use of the `unserialize` function, a known vector for remote code execution if not handled with extreme caution and input validation, is present twice. While the plugin does not have a history of known vulnerabilities, this could indicate a lack of thorough auditing or that past versions were not as widely used or scrutinized. The plugin also lacks any nonce checks, which is a critical security measure for AJAX requests. The overall posture is one of significant risk due to the unprotected AJAX endpoints and the potential danger of unserialization.