Project Cost Calculator Security & Risk Analysis

The "project-cost-calculator" plugin v1.0.0 exhibits a concerning security posture, primarily due to a significant number of unprotected entry points. With 12 out of 13 identified entry points lacking authentication checks, the plugin presents a broad attack surface. While the static analysis shows good practices in output escaping and limited use of dangerous functions, the absence of capability checks on AJAX handlers is a critical oversight. The presence of one unsanitized path in the taint analysis, although not rated as critical or high, warrants attention as it could potentially lead to unintended behavior or data exposure.

The vulnerability history, featuring a medium severity CVE from August 2025 marked as unpatched, reinforces the concerns about the plugin's security. The common vulnerability type of 'Missing Authorization' is directly reflected in the static analysis findings. The plugin's strength lies in its proper handling of SQL queries (43% prepared) and the high rate of output escaping (97%). However, the unpatched CVE and the multitude of unprotected AJAX endpoints severely undermine these strengths, suggesting a need for immediate remediation to address authorization flaws and the outstanding vulnerability.