Office Locator Security & Risk Analysis

The "office-locator" plugin v1.3.0 presents a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and implementing nonce checks on all AJAX handlers, several significant concerns elevate its risk profile. The presence of three AJAX handlers without authentication checks creates a substantial attack surface for unauthorized actions. Furthermore, the plugin has a concerning history of known vulnerabilities, with two unpatched high-severity CVEs, specifically SQL injection and PHP Remote File Inclusion. This history, coupled with the recent nature of the last reported vulnerability (2025), suggests a pattern of recurring security flaws and a lack of timely patching, which is a critical indicator of ongoing security weaknesses.

The static analysis reveals potential issues with unsanitized paths in two taint flows, although they are not classified as critical or high severity. However, the vulnerability history, especially the unpatched SQL injection and PHP RFI, directly relates to common attack vectors. The plugin's overall risk is amplified by these historical issues and the exposed AJAX endpoints, despite some positive coding practices. The conclusion is that while the plugin has some robust security implementations, the unpatched high-severity vulnerabilities and unprotected entry points necessitate immediate attention and mitigation.