Proofratings Security & Risk Analysis

The 'proofratings' plugin v1.1.9 exhibits a concerning security posture primarily due to a significant number of unprotected entry points. With 11 out of 16 total entry points lacking authentication or permission checks, this plugin exposes a large attack surface to unauthenticated users, increasing the risk of unauthorized actions. While the plugin demonstrates good practices in using prepared statements for SQL queries and has a history free of reported vulnerabilities, these strengths are overshadowed by the critical lack of access control on its AJAX handlers and REST API routes. The taint analysis did not reveal critical or high severity vulnerabilities, which is positive, but the presence of unsanitized paths in the analyzed flows warrants attention, especially given the unprotected entry points. The plugin's lack of bundled libraries and a clean vulnerability history are notable strengths, but the fundamental security flaws in its access control mechanisms present a substantial risk that needs to be addressed.