MailerLite – Signup forms (official) Security & Risk Analysis

The "official-mailerlite-sign-up-forms" plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query handling and includes a reasonable number of nonce and capability checks, significant concerns remain. The presence of unprotected AJAX handlers presents a direct attack surface that could be exploited by unauthenticated users. Furthermore, the taint analysis revealed two high-severity flows with unsanitized paths, indicating potential vulnerabilities that could lead to data compromise or unauthorized actions. The plugin's vulnerability history is a major red flag, with a substantial number of past CVEs, including critical and high-severity issues. The common vulnerability types like Missing Authorization, CSRF, XSS, and SQL Injection, coupled with a recent critical vulnerability, suggest a pattern of recurring security weaknesses that have not been fully addressed.