QQWorld通行证 / QQWorld Passport Security & Risk Analysis

The "qqworld-passport" plugin, version 1.2.1, exhibits a mixed security posture. On the surface, the plugin presents a very small attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events. Furthermore, there are no reported historical vulnerabilities (CVEs) associated with this plugin, which is generally a positive indicator. However, the static analysis reveals significant underlying code quality concerns that overshadow the apparent lack of external entry points.

The plugin's code signals are alarming. A single SQL query is present, and it is not using prepared statements, posing a risk of SQL injection if user-controlled data is incorporated into this query. More critically, only 3% of the 144 output operations are properly escaped, indicating a widespread Cross-Site Scripting (XSS) vulnerability risk across multiple output points. The taint analysis identified two flows with unsanitized paths, further reinforcing the XSS concerns. The complete absence of nonce and capability checks on any identified entry points (even if the count is zero) means that if any were to be introduced or discovered in the future, they would be inherently insecure.

While the lack of historical vulnerabilities is good, it could also simply mean the plugin hasn't been extensively audited or exploited yet. The significant number of unescaped outputs and the raw SQL query represent substantial, readily exploitable weaknesses that require immediate attention. The absence of any detected entry points does not negate the risks posed by the insecure coding practices within the plugin itself.