Notifadz by Adrenalead – Web Push Notifications Security & Risk Analysis

The "notifadz-by-adrenalead-web-push-notifications" plugin, version 3.0.27, exhibits a concerning security posture primarily due to a significant number of unprotected AJAX endpoints. While the plugin demonstrates good practices in SQL query handling with 100% prepared statements and a high percentage of output escaping, the absence of authorization checks on all 11 identified AJAX handlers presents a substantial attack surface. This means any unauthenticated user could potentially interact with these endpoints, leading to unintended actions or information disclosure if the underlying code is vulnerable. The taint analysis, though limited in scope, did not reveal any critical or high-severity unsanitized flows, and the lack of any recorded past vulnerabilities is a positive indicator. However, the identified weaknesses in authentication for AJAX handlers cannot be overlooked, creating a notable risk.