myCred – Zapier Integration Security & Risk Analysis

The "mycred-zapier" v1.0.9 plugin presents a significant security risk due to a large attack surface with no authentication or authorization checks on its entry points. All 6 identified REST API routes lack permission callbacks, meaning any authenticated user, regardless of role, could potentially interact with these endpoints. While the code analysis indicates good practices in using prepared statements for SQL queries and a lack of dangerous functions or file operations, the absence of capability checks and nonce verification on these REST API routes is a critical oversight. The vulnerability history shows no past issues, which is positive, but it doesn't mitigate the current high-risk configuration. The plugin's security posture is concerningly weak in its access control mechanisms despite seemingly solid internal coding practices. The lack of output escaping on over half of the identified outputs also introduces a risk of cross-site scripting (XSS) vulnerabilities.