PushRelay – Push Notifications Security & Risk Analysis

The Push Relay plugin v1.7.3 exhibits a generally strong security posture, with excellent practices in output escaping and a very low percentage of SQL queries not using prepared statements. The plugin also demonstrates a commitment to security with a high number of nonce and capability checks. However, the static analysis reveals a concerning number of unprotected entry points, specifically 2 REST API routes that lack permission callbacks. Furthermore, the taint analysis indicates 5 high-severity flows with unsanitized paths, which represent a significant risk of potential vulnerabilities if these paths are exposed to untrusted input. While the plugin has no recorded vulnerability history (CVEs), the presence of high-severity taint flows suggests potential for undiscovered vulnerabilities. The lack of historical vulnerabilities could imply either a robust development process or simply a lack of prior in-depth security auditing that might uncover these taint issues.