Scroll Top – Qubemet Security & Risk Analysis

The "qmt-scroll" v1.0.1 plugin exhibits several concerning security weaknesses despite a clean vulnerability history. The static analysis reveals a significant attack surface, with 2 out of 2 total entry points (REST API routes) lacking permission callbacks. This means these routes are accessible to any user, potentially allowing unauthorized actions or data disclosure. While the plugin demonstrates good practices in avoiding dangerous functions, performing SQL queries exclusively with prepared statements, and having a nonce check, the unprotected REST API routes represent a critical vulnerability.