Tussendoor – Open RDW Security & Risk Analysis

The "open-rdw-kenteken-voertuiginformatie" plugin version 5.3.0 presents a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of output escaping, which mitigates common injection vulnerabilities. The absence of critical or high-severity taint flows is also reassuring.

However, significant concerns arise from the attack surface. The plugin exposes two AJAX handlers without any authentication or capability checks, creating a direct pathway for unauthenticated users to interact with potentially sensitive functionalities. The lack of any nonce checks on these handlers further exacerbates this risk, making them vulnerable to Cross-Site Request Forgery (CSRF) attacks. While there are no currently unpatched CVEs, the plugin has a history of Cross-site Scripting (XSS) vulnerabilities, with the last one in March 2023. This suggests a recurring pattern that, combined with the current lack of input validation on AJAX handlers, indicates a potential for new XSS flaws.

In conclusion, while the plugin has strengths in its database query handling and output escaping, the unprotected AJAX endpoints are a critical weakness that requires immediate attention. The historical XSS vulnerabilities, coupled with the current lack of input validation on these entry points, makes it susceptible to further exploitation. Addressing these unprotected entry points and implementing proper authorization and nonce checks is paramount for improving its security.