Oumma Contact – Drag & Drop Contact Form Builder Security & Risk Analysis

The "oumma-contact" plugin v10.1.2 presents a mixed security posture. It demonstrates good practices in terms of output escaping, with an exceptionally high rate of properly escaped outputs, and a respectable number of nonce and capability checks. The absence of known vulnerabilities in its history is a positive indicator of past security diligence.

However, the static analysis reveals significant security concerns. The presence of two AJAX handlers lacking authentication checks represents a direct vulnerability that could allow unauthorized users to trigger plugin functionality. Furthermore, the taint analysis identified two flows with unsanitized paths, both classified as high severity. These unsanitized paths, combined with the unprotected AJAX endpoints, suggest a potential for cross-site scripting (XSS) or other injection vulnerabilities if user-supplied data is not properly validated and sanitized before being used in sensitive operations.

While the plugin's history of zero CVEs is a strong point, the immediate findings from the static and taint analysis cannot be ignored. The critical risk stems from the unprotected entry points and the high-severity taint flows, indicating potential for exploitation. A balanced conclusion is that the plugin has some foundational security practices in place, but the identified weaknesses in authentication and input sanitization on specific entry points require immediate attention.