Opes WP Ads Manager Security & Risk Analysis

The "opes-wp-ads-manager" plugin v1.2.0 presents a significant security risk primarily due to its unprotected AJAX endpoints. With all 9 identified AJAX handlers lacking authentication checks, an unauthenticated attacker could potentially trigger arbitrary actions within the plugin, leading to a compromise of the WordPress site. The presence of the `unserialize` function, a known source of remote code execution vulnerabilities when handling untrusted data, further exacerbates this risk. While the plugin has no recorded vulnerability history or external HTTP requests, its lack of input sanitization and output escaping on a substantial portion of its outputs, coupled with all SQL queries being susceptible to injection attacks due to the absence of prepared statements, indicates a general lack of robust security practices.

The static analysis reveals critical weaknesses in its attack surface management and data handling. The absence of proper nonce and capability checks on the AJAX endpoints means that any user, even an anonymous one, could potentially interact with these functions. The lack of prepared statements for all SQL queries opens the door to SQL injection, which can lead to data theft, modification, or even complete database compromise. The low percentage of properly escaped outputs suggests that cross-site scripting (XSS) vulnerabilities are also a distinct possibility. Given these findings, the overall security posture is poor, and immediate remediation is strongly advised.