Personalised Gift Supply – Listing Tool Security & Risk Analysis

The "personalised-gift-supply-listing-tool" plugin version 1.0.6 presents a mixed security posture. While the vast majority of its output is properly escaped and it boasts a clean vulnerability history with no known CVEs, there are significant concerns regarding its attack surface and data handling. The presence of three REST API routes without permission callbacks is a critical flaw, potentially allowing unauthorized access and manipulation of plugin functionality. Additionally, the analysis indicates three flows with unsanitized paths, although these did not reach a critical or high severity in the static analysis, they still represent potential entry points for vulnerabilities if not handled with extreme care. The complete lack of capability checks and the reliance on nonce checks alone for some entry points are also weaknesses that increase the risk profile.