Orbisius CyberStore Security & Risk Analysis

The static analysis of orbisius-cyberstore v2.1.7 reveals several concerning areas despite a seemingly small attack surface and no recorded CVEs. While there are no obvious vulnerabilities in AJAX handlers or REST API routes due to the presence of authentication and permission checks, the code contains a dangerous use of `unserialize` which is a common vector for remote code execution if user-supplied data is unserialized without proper validation. Furthermore, all SQL queries are executed without prepared statements, increasing the risk of SQL injection attacks. The taint analysis indicates multiple flows with unsanitized paths, four of which are classified as high severity, suggesting that data entering the application is not being sufficiently cleaned before being used in sensitive operations. The low percentage of properly escaped output (9%) also points to potential Cross-Site Scripting (XSS) vulnerabilities.

Despite the absence of documented vulnerabilities, the code quality signals are weak. The lack of nonce checks on the identified entry points (AJAX handlers and shortcodes) is a significant oversight, leaving them potentially vulnerable to Cross-Site Request Forgery (CSRF) attacks. The high number of file operations combined with external HTTP requests also warrants closer inspection for potential security implications. The vulnerability history being clean could be attributed to luck or a lack of deep security auditing in the past, rather than inherent robust security. Overall, while the plugin doesn't have publicly known vulnerabilities, the static analysis highlights critical areas of concern that significantly lower its security posture.