Contact Form & SMTP Plugin for WordPress by PirateForms Security & Risk Analysis

The pirate-forms plugin v2.6.1 exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns remain regarding its attack surface. The presence of two AJAX handlers without authentication checks creates a direct entry point for unauthenticated attackers to interact with the plugin's backend logic. This is particularly worrisome given the plugin's history of vulnerabilities, including critical and high severity Cross-site Scripting (XSS) and Code Injection flaws. Although no currently unpatched CVEs are listed, the recurring nature of these severe vulnerability types in the past suggests a pattern of insecure input handling that could be present in this version. The plugin's strengths lie in its secure data handling for SQL and output, but the unprotected AJAX endpoints coupled with past vulnerability trends elevate the risk profile.