Om Contact Form Security & Risk Analysis

This plugin exhibits a concerning security posture, primarily due to a significant lack of input validation and access control across its entry points. The static analysis reveals a substantial attack surface with 4 out of 5 entry points (AJAX handlers and shortcodes) lacking any authentication or capability checks. Furthermore, all SQL queries are executed without prepared statements, posing a high risk of SQL injection vulnerabilities. The complete absence of output escaping is equally alarming, indicating that any data processed by the plugin could be directly reflected in the user's browser, leading to cross-site scripting (XSS) attacks.

The taint analysis shows 4 flows with unsanitized paths, which, when combined with the lack of escaping and authentication, strongly suggests potential vulnerabilities that could be exploited. The absence of any recorded historical vulnerabilities, while seemingly positive, does not negate the current risks. It may indicate that the plugin has not been thoroughly audited or has not been targeted previously. Therefore, despite the lack of known CVEs, the plugin's current implementation presents significant security weaknesses that require immediate attention.