NMR Strava activities Security & Risk Analysis

The nmr-strava-activities plugin v1.0.11 exhibits a mixed security posture. On the positive side, it demonstrates good practices in SQL query handling, with 91% utilizing prepared statements, and strong output escaping, with 94% of outputs properly escaped. The plugin also includes some nonce checks and avoids dangerous functions. However, significant concerns arise from its attack surface and taint analysis. The presence of an unprotected AJAX handler, which is a direct entry point, is a critical weakness. Furthermore, the taint analysis revealed two flows with unsanitized paths classified as high severity, indicating potential for input manipulation to lead to vulnerabilities. The plugin's vulnerability history, while currently showing no unpatched CVEs, includes a past medium-severity cross-site scripting vulnerability, suggesting a propensity for certain types of input validation issues. The overall picture is one of a plugin with some solid security foundations but with critical vulnerabilities in its input handling and exposed entry points that require immediate attention.