PausAR – 3D and AR Viewer Metrics Security & Risk Analysis

The "pausar-metrics" v1.0.7 plugin demonstrates several positive security practices, including the exclusive use of prepared statements for all SQL queries and proper output escaping for all outputs, indicating a good understanding of fundamental security principles. The absence of known vulnerabilities and common vulnerability types in its history is also a strong indicator of a relatively secure codebase. However, a significant concern arises from the presence of one unprotected REST API route, which represents a direct entry point into the application without any authentication or authorization checks. This lack of protection on an exposed endpoint is a critical oversight. Furthermore, the taint analysis revealed one flow with an unsanitized path, classified as high severity, which could potentially lead to unintended behavior or vulnerabilities if not addressed. While the plugin avoids dangerous functions and file operations, and has a reasonable number of nonce and capability checks, the unprotected REST API route and the high-severity taint flow are significant weaknesses that expose the application to potential risks.