Prihlasovanie na sväté omše Security & Risk Analysis

The "prihlasovanie-na-svate-omse" v1.9.1 plugin presents a significant security risk due to a large number of unprotected AJAX handlers and a complete lack of nonce and capability checks. While the static analysis indicates no dangerous functions or direct external HTTP requests, the 13 AJAX handlers without authentication checks create a substantial attack surface. The taint analysis revealing 9 flows with unsanitized paths, all of critical severity, directly points to potential vulnerabilities where user input could be misused to manipulate the application, likely leading to unauthorized actions or data exposure. The plugin's vulnerability history is clean, which might suggest a lack of previous scrutiny or a low profile. However, the current code analysis reveals fundamental security oversights that, if exploited, could be severe. The extensive use of raw SQL queries without prepared statements further exacerbates the risk, making it susceptible to SQL injection attacks. The moderate rate of properly escaped output is a slight positive, but does not mitigate the critical issues found in the taint analysis and unprotected entry points.